Edit tour

Windows Analysis Report
4ui8luUSNp.exe

Overview

General Information

Sample name:	4ui8luUSNp.exe renamed because original name is a hash value
Original sample name:	5a6beb7ab22fc65258d7d3681ce668058f93b7a2eb534b42b799aa8e61595c08.exe
Analysis ID:	1536323
MD5:	267b10eca642bbc3534be32cbc565f35
SHA1:	95deb7c1dcfba5144100a5d73cb25218f304e3f4
SHA256:	5a6beb7ab22fc65258d7d3681ce668058f93b7a2eb534b42b799aa8e61595c08
Tags:	exemailum-comuser-JAMESWT_MHT
Infos:

Detection

Coinhive, Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Coinhive miner

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

Drops executables to the windows directory (C:\Windows) and starts them

Machine Learning detection for dropped file

Machine Learning detection for sample

May modify the system service descriptor table (often done to hook functions)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks if the current process is being debugged

Connects to many different domains

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Creates files inside the system directory

Detected non-DNS traffic on DNS port

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains sections with non-standard names

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses SMTP (mail sending)

Classification

Process Tree

System is w10x64

4ui8luUSNp.exe (PID: 7524 cmdline: "C:\Users\user\Desktop\4ui8luUSNp.exe" MD5: 267B10ECA642BBC3534BE32CBC565F35)

videodrv.exe (PID: 7544 cmdline: C:\Windows\videodrv.exe MD5: 267B10ECA642BBC3534BE32CBC565F35)

WerFault.exe (PID: 8064 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7544 -s 18336 MD5: C31336C1EFC2CCB44B4326EA793040F2)

videodrv.exe (PID: 7744 cmdline: "C:\Windows\videodrv.exe" MD5: 267B10ECA642BBC3534BE32CBC565F35)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000003.1555453252.0000000003CD3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000003.00000003.1555453252.0000000003CD3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Coinhive	Yara detected Coinhive miner	Joe Security
00000001.00000003.1503431451.0000000003523000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000001.00000003.1503431451.0000000003523000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Coinhive	Yara detected Coinhive miner	Joe Security

Sigma Signatures

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 142.251.9.27, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Windows\videodrv.exe, Initiated: true, ProcessId: 7544, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49764

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\videodrv.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\4ui8luUSNp.exe, ProcessId: 7524, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VideoDriver

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 4ui8luUSNp.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Windows\exe.tmp	Avira: detection malicious, Label: WORM/Mimail.A2
Source:	Avira: detection malicious, Label: WORM/Mimail.A2
Source: C:\Windows\videodrv.exe	Avira: detection malicious, Label: WORM/Mimail.A1
Source: C:\Windows\zip.tmp	Avira: detection malicious, Label: WORM/Mimail.A2

Multi AV Scanner detection for dropped file

Source: C:\Windows\videodrv.exe

ReversingLabs: Detection: 94%

Multi AV Scanner detection for submitted file

Source: 4ui8luUSNp.exe

ReversingLabs: Detection: 94%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Windows\videodrv.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 4ui8luUSNp.exe

Joe Sandbox ML: detected

Bitcoin Miner

Yara detected Coinhive miner

Source: Yara match	File source: 00000003.00000003.1555453252.0000000003CD3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1503431451.0000000003523000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: 00000003.00000003.1555453252.0000000003CD3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1503431451.0000000003523000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Source: 4ui8luUSNp.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source:

Binary string: d:\os\obj\amd64fre\minkernel\ntos\init\mp\objfre\amd64\typeinfo\ntkrnlmp.pdb source: videodrv.exe, 00000001.00000003.1538006054.0000000004E22000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\4ui8luUSNp.exe

Code function: 0_2_00402C3E 1001F200,1001F284,1001F284,1001E65C,FindFirstFileA,1001E6C4,1001E6C4,1001E660,1001E65C,1001E65C,1001E660,1001E65C,1001E5C5,FindNextFileA,

0_2_00402C3E

Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Adobe\	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\	Jump to behavior

Source: unknown

Network traffic detected: DNS query count 49

Source: global traffic	TCP traffic: 192.168.2.7:61720 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.7:61529 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 212.227.15.41 212.227.15.41

Source: global traffic	TCP traffic: 192.168.2.7:49764 -> 142.251.9.27:25
Source: global traffic	TCP traffic: 192.168.2.7:49845 -> 74.125.206.27:25
Source: global traffic	TCP traffic: 192.168.2.7:61652 -> 52.101.42.5:25
Source: global traffic	TCP traffic: 192.168.2.7:61653 -> 74.125.200.26:25
Source: global traffic	TCP traffic: 192.168.2.7:61667 -> 193.42.222.38:25
Source: global traffic	TCP traffic: 192.168.2.7:61671 -> 52.101.73.28:25
Source: global traffic	TCP traffic: 192.168.2.7:61727 -> 212.227.15.41:25
Source: global traffic	TCP traffic: 192.168.2.7:61732 -> 116.202.20.146:25
Source: global traffic	TCP traffic: 192.168.2.7:61736 -> 217.13.200.22:25
Source: global traffic	TCP traffic: 192.168.2.7:61738 -> 85.13.166.174:25
Source: global traffic	TCP traffic: 192.168.2.7:61740 -> 91.198.189.25:25

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1

Source: videodrv.exe, 00000001.00000003.1500934319.0000000003EFD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "www.facebook.com", equals www.facebook.com (Facebook)
Source: videodrv.exe, 00000001.00000003.1523012493.00000000046F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/, equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: mozilla.org
Source: global traffic	DNS traffic detected: DNS query: search.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: mozilla.com
Source: global traffic	DNS traffic detected: DNS query: aspmx3.googlemail.com
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: smtp.google.com
Source: global traffic	DNS traffic detected: DNS query: outlook.com
Source: global traffic	DNS traffic detected: DNS query: 2x.png
Source: global traffic	DNS traffic detected: DNS query: accv.es
Source: global traffic	DNS traffic detected: DNS query: trustcentre.co.za
Source: global traffic	DNS traffic detected: DNS query: gmail.com
Source: global traffic	DNS traffic detected: DNS query: mtin.es
Source: global traffic	DNS traffic detected: DNS query: outlook-com.olc.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: alt4.gmail-smtp-in.l.google.com
Source: global traffic	DNS traffic detected: DNS query: catcert.net
Source: global traffic	DNS traffic detected: DNS query: e-szigno.hu
Source: global traffic	DNS traffic detected: DNS query: sk.ee
Source: global traffic	DNS traffic detected: DNS query: in.hes.trendmicro.eu
Source: global traffic	DNS traffic detected: DNS query: mail.microsec.hu
Source: global traffic	DNS traffic detected: DNS query: sk-ee.mail.protection.outlook.com
Source: global traffic	DNS traffic detected: DNS query: chambersign.org
Source: global traffic	DNS traffic detected: DNS query: garagejournal.com
Source: global traffic	DNS traffic detected: DNS query: tripadvisor.com
Source: global traffic	DNS traffic detected: DNS query: mylivewallpapers.com
Source: global traffic	DNS traffic detected: DNS query: candidate.hr-manager.net
Source: global traffic	DNS traffic detected: DNS query: ads.talkscreativity.com
Source: global traffic	DNS traffic detected: DNS query: belgieninfo.net
Source: global traffic	DNS traffic detected: DNS query: mx00.ionos.de
Source: global traffic	DNS traffic detected: DNS query: delamar.de
Source: global traffic	DNS traffic detected: DNS query: googlewatchblog.de
Source: global traffic	DNS traffic detected: DNS query: pommes.hebbet.de
Source: global traffic	DNS traffic detected: DNS query: lintorfer.eu
Source: global traffic	DNS traffic detected: DNS query: schule-studium.de
Source: global traffic	DNS traffic detected: DNS query: mx2.schule-studium.de
Source: global traffic	DNS traffic detected: DNS query: windowspower.de
Source: global traffic	DNS traffic detected: DNS query: w0187a3c.kasserver.com
Source: global traffic	DNS traffic detected: DNS query: wirsiegen.de
Source: global traffic	DNS traffic detected: DNS query: mx04.mail.millenniumarts.net
Source: global traffic	DNS traffic detected: DNS query: wp.com
Source: global traffic	DNS traffic detected: DNS query: guenstiger.de
Source: global traffic	DNS traffic detected: DNS query: games.ch
Source: global traffic	DNS traffic detected: DNS query: zentrum-der-gesundheit.de
Source: global traffic	DNS traffic detected: DNS query: stroeerdigitalgroup.de
Source: global traffic	DNS traffic detected: DNS query: radiosantiago.cl
Source: global traffic	DNS traffic detected: DNS query: fanpelis.ac
Source: global traffic	DNS traffic detected: DNS query: blog.lesoir.be
Source: global traffic	DNS traffic detected: DNS query: mozilla.org.xpi

Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv1.crl0
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv10.crl0
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://acraiz.icpbrasil.gov.br/LCRacraizv2.crl0
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ads.sisal.it/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ads.williamhill.it/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://adv.comunicareimpresa.com/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://adv.ilsole24ore.it/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://affiliazioniads.snai.it/
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/DPCyPoliticas0
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/DPCyPoliticas0g
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/crl/MTINAutoridadRaiz03
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ca.mtin.es/mtin/ocsp0
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0
Source: videodrv.exe, 00000001.00000003.1444406864.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1476433531.000000000352F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/Dig
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004131000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000045E1000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1515194577.00000000051CB000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000045D9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.0000000004191000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.0000000003556000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004131000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1477354145.00000000046D1000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.000000000352F000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1477354145.0000000004BC9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1511374818.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510001960.000000000353F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: videodrv.exe, 00000001.00000003.1444521942.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1476511575.000000000352A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004131000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000045E1000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1477354145.0000000004579000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1477354145.00000000046D1000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.000000000352F000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.0000000004191000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1477354145.0000000004BC9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444406864.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1515194577.0000000004923000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1511374818.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444521942.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.0000000003556000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1476433531.000000000352F000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1476511575.000000000352A000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1454608483.0000000003EFB000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510001960.000000000353F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004131000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000045E1000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1515194577.00000000051CB000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000045D9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.0000000004191000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444406864.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.0000000003556000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1476433531.000000000352F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004131000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1515194577.0000000004923000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1454608483.0000000003EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004131000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000045E1000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1515194577.00000000051CB000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000045D9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.0000000004191000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.0000000003556000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt0
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004131000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1477354145.00000000046D1000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.000000000352F000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1477354145.0000000004BC9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1511374818.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510001960.000000000353F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt0
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://certs.oati.net/repository/OATICA2.crl0
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://certs.oati.net/repository/OATICA2.crt0
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://certs.oaticerts.com/repository/OATICA2.crl
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://certs.oaticerts.com/repository/OATICA2.crt08
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://clkuk.tradedoubler.com/
Source: videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersignroot.html0
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cps.siths.se/sithsrootcav1.html0
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crazylead.com/video/
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersignroot.crl0
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.defence.gov.au/pki0
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.postsignum.cz/crl/psrootqca4.crl02
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.postsignum.eu/crl/psrootqca4.crl0
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl1.comsign.co.il/crl/comsignglobalrootca.crl0
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl2.postsignum.cz/crl/psrootqca4.crl01
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004131000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000045E1000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1515194577.00000000051CB000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000045D9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.0000000004191000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.0000000003556000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004131000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1477354145.00000000046D1000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.000000000352F000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1477354145.0000000004BC9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1511374818.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510001960.000000000353F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004131000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000045E1000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1515194577.00000000051CB000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000045D9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.0000000004191000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444406864.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.0000000003556000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1476433531.000000000352F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004131000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000045E1000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1477354145.0000000004579000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1477354145.00000000046D1000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.000000000352F000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.0000000004191000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1477354145.0000000004BC9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444406864.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1515194577.0000000004923000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1511374818.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444521942.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.0000000003556000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1476433531.000000000352F000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1476511575.000000000352A000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1454608483.0000000003EFB000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510001960.000000000353F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004131000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1515194577.0000000004923000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1454608483.0000000003EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl07
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004131000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1477354145.00000000046D1000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.000000000352F000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1477354145.0000000004BC9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1511374818.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510001960.000000000353F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigicertSHA2Secure
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004131000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000045E1000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1515194577.00000000051CB000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000045D9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.0000000004191000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.0000000003556000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004131000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.0000000004191000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444406864.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.000000000359F000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1476433531.000000000352F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004131000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000045E1000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1515194577.00000000051CB000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000045D9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.0000000004191000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.0000000003556000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004131000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000045E1000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1477354145.0000000004579000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1477354145.00000000046D1000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.000000000352F000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.0000000004191000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1477354145.0000000004BC9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444406864.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1515194577.0000000004923000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1511374818.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444521942.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.0000000003556000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1476433531.000000000352F000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1476511575.000000000352A000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1454608483.0000000003EFB000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510001960.000000000353F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004131000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1515194577.0000000004923000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1454608483.0000000003EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG3.crl0
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004131000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1477354145.00000000046D1000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.000000000352F000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1477354145.0000000004BC9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1511374818.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510001960.000000000353F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004131000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000045E1000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1515194577.00000000051CB000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000045D9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0
Source: videodrv.exe, 00000001.00000003.1445684065.0000000004191000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.0000000003556000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0~
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://direct.juiceadv.com/aff_
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://display.tracksafe.click/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://diventarehackerblog.altervista.org/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edintorni.net/related/service/sponsor/redirect/?
Source: videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fb.me/use-check-prop-types
Source: videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fb.me/use-check-prop-typesG
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fedir.comsign.co.il/crl/comsignglobalrootca.crl0;
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ib.adnxs.com/clktrb?id=
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://labseo.ddns.net/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://media.vincitu.it/C.ashx?
Source: videodrv.exe, 00000001.00000003.1523012493.00000000046F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org
Source: videodrv.exe, 00000001.00000003.1454386841.0000000003AF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://msn.com
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://native.publy.com/related/service/sponsor/redirect/?
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digi
Source: videodrv.exe, 00000001.00000003.1444793486.0000000003556000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.co
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004131000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000045E1000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1515194577.00000000051CB000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1477354145.0000000004579000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1477354145.00000000046D1000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000045D9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.000000000352F000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.0000000004191000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1477354145.0000000004BC9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444406864.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1515194577.0000000004923000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1511374818.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444521942.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.0000000003556000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1476433531.000000000352F000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1476511575.000000000352A000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1454608483.0000000003EFB000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510001960.000000000353F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004131000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.0000000004191000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444406864.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.000000000359F000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1476433531.000000000352F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004131000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000045E1000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1515194577.00000000051CB000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000045D9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.0000000004191000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.0000000003556000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004131000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1477354145.00000000046D1000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.000000000352F000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1477354145.0000000004BC9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1511374818.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510001960.000000000353F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004131000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.0000000004191000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.000000000359F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004131000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444406864.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1476433531.000000000352F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.msocsp.com0S
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pki.registradores.org/normativa/index.htm0
Source: videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://policy.camerfirma.com0
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://postsignum.ttc.cz/crl/psrootqca2.crl0
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/0
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://rover.ebay.com/
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sertifikati.ca.posta.rs/crl/PostaCARoot.crl0
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shrsl.com/
Source: videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://stackoverflow.com/questions/30030031)
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tiny.cc/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tisca.li/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tracker.tradedoubler.com/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tracking.performoney.it/
Source: videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.acabogacia.org/doc0
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.agesic.gub.uy/acrn/acrn.crl0)
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.agesic.gub.uy/acrn/cps_acrn.pdf0
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ancert.com/cps0
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bet365.it/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.betwin.co.it
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.booking.com/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bookings.net/
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ca.posta.rs/dokumentacija0h
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/0
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.chambersign.org1
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004131000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1477354145.00000000046D1000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.000000000352F000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.0000000004191000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1477354145.0000000004BC9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1511374818.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.0000000003556000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510001960.000000000353F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004131000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000045E1000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1515194577.00000000051CB000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000045D9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0~
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.djpoint.net/
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.dnie.es/dpc0
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ecee.gov.pt/dpc0
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.globaltrust.info0
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.globaltrust.info0=
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.herobet.it/
Source: videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1523012493.00000000046F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul(
Source: videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulR
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.oaticerts.com/repository.
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.pki.admin.ch/cps/CPS_2_16_756_1_17_3_1_0.pdf09
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.postsignum.cz/crl/psrootqca2.crl02
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.rentalcars.com/?affiliateCode=
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.rietilife.com?pasID=
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sostariffe.it/tracker2.php?
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.tostadora.it/t-shirt-nerd.php?
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.uce.gub.uy/acrn/acrn.crl0
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www2.postsignum.cz/crl/psrootqca2.crl01
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://4kmovies.online/download/
Source: videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://M365CDN.nel.measure.office-92
Source: videodrv.exe, 00000001.00000003.1476433531.000000000352F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://M365CDN.nel.measure.office.net/api/report?FrontEnd=VerizonCDNWorldWide&DestinationEndpoint=P
Source: videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ads.pubbliemme-adv.net/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ads.sisal.it/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://adserver.html.it/
Source: videodrv.exe, 00000001.00000003.1444521942.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.0000000003556000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1476511575.000000000352A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aefd.nel
Source: videodrv.exe, 00000001.00000003.1444793486.0000000003556000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aefd.nelr
Source: videodrv.exe, 00000001.00000003.1515194577.0000000004CB3000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000044F1000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1515194577.0000000004C8B000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444521942.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.0000000004098000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000040A1000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1476511575.000000000352A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaot
Source: videodrv.exe, 00000001.00000003.1476511575.000000000352A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaotak
Source: videodrv.exe, 00000001.00000003.1515194577.0000000004CB3000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1477354145.0000000004529000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000044F1000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.000000000359F000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1515194577.0000000004C8B000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444521942.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.0000000003556000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000040A1000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1476511575.000000000352A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingrms
Source: videodrv.exe, 00000001.00000003.1515194577.0000000004D2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingth
Source: videodrv.exe, 00000001.00000003.1515194577.0000000004CB3000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1515194577.000000000485B000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000044F1000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444521942.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1476511575.000000000352A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=wsb
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://affiliate.across.it/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://affiliati.gointernet.it/verify/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://affiliation.software/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://affiliazioniads.snai.it/
Source: videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amzn.to/
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004C71000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.000000000359F000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510001960.000000000353F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: videodrv.exe, 00000001.00000003.1454386841.0000000003AF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/fre/107.0.1418.52/main.bundle.js
Source: videodrv.exe, 00000001.00000003.1454386841.0000000003AF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/fre/version.json
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004C71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
Source: videodrv.exe, 00000001.00000003.1454386841.0000000003AF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://azureedge.net
Source: videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://baidu.com
Source: videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://basket.mozilla.org/news/subscribe/
Source: videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://basket.mozilla.org/news/subscribe_sms/
Source: videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://basket.mozilla.org/subscribe.json
Source: videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://c.mtpc.se/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://campaigns.williamhill.it/C.ashx?
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://casinohex.it/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://casinostudio3000.com/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clk.tradedoubler.com/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clkuk.tradedoubler.com/
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004C71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://config.edge.skype.com/config/v1/ODSP_Sync_Client/19.043.0304.0013?UpdateRing=Prod&OS=Win&OSV
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004C71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cxcs.microsoft.net/api/settings/en-GB/xml/settings-tipset?release=20h1&sku=Professional&plat
Source: videodrv.exe, 00000001.00000003.1454608483.0000000003EFB000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510001960.000000000353F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://direct.piuannews.com/aff_
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://disneyplus.bn5x.net/
Source: videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ebay.com
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ebay.it/?mkcid=
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ebay.to/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ebay.us/
Source: videodrv.exe, 00000001.00000003.1515194577.0000000004D2B000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecfdb90f321c52ef6e93077f63413543.azr.footprintdns.com/apc/trans.gif?bd78002c55888096ce060c58
Source: videodrv.exe, 00000001.00000003.1515194577.0000000004D2B000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecfdb90f321c52ef6e93077f63413543.azr.footprintdns.com/apc/trans.gif?c2fcd52267835a3e34f9ac05
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004C71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecs.nel.measure.office.net?TenantId=ODSP_Sync_Client&DestinationEndpoint=Edge-Prod-LAX31r5c&
Source: videodrv.exe, 00000001.00000003.1454386841.0000000003AF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fb.me/react-polyfillsO
Source: videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fb.me/react-polyfillsP
Source: videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fb.me/react-polyfillsPO
Source: videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/browser/components/newtab/content-src/asrouter/docs/debuggin
Source: videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsm
Source: videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsmr
Source: videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/nimbus-desktop-experiments
Source: videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordsi
Source: videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1i
Source: videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1i#
Source: videodrv.exe, 00000001.00000003.1515194577.0000000004D2B000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.0000000003556000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fp-afd.azurefd.us/apc/trans.gif?69c749c200c753dfb00f5bc8299ab8eb
Source: videodrv.exe, 00000001.00000003.1515194577.0000000004D2B000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.0000000003556000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fp-afd.azurefd.us/apc/trans.gif?a2555e10569a45fe03b885d268c50da9
Source: videodrv.exe, 00000001.00000003.1515194577.0000000004D2B000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.0000000003556000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fp-as.azureedge.net/apc/trans.gif?23ecc2fb73d617d9826364f47d1067db
Source: videodrv.exe, 00000001.00000003.1515194577.0000000004D2B000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.0000000003556000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fp-as.azureedge.net/apc/trans.gif?7bac4e73e9b20fcc41dc97447167937d
Source: videodrv.exe, 00000001.00000003.1515194577.0000000004D2B000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.0000000003556000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fp.msedge.net/conf/v2/asgw/fpconfig.min.json?monitorId=asgw
Source: videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/
Source: videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/a4
Source: videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/collections
Source: videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/
Source: videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/read/$
Source: videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/projectfluent/fluent.js/wiki/React-Overlays.
Source: videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.ketchupadv.it/aff_
Source: videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://group.intesasanpaolo.com/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://guarda4k.online/
Source: videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.getpocket.com/article/1142-firefox-new-tab-recommendations-faq
Source: videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881a
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpslink.com/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ic.aff-handler.com/
Source: videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/7
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iptv01.tw/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iqbroker.com/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://is.gd/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://it.banggood.com/marketing-
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://it.dhgate.com/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://jooble.org/images/logo_48x61.gif)
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://link.offerte2019.info/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://link.offerte2019.space/
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004891000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.0000000003C71000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1477354145.0000000004841000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004891000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.0000000003C71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: videodrv.exe, 00000001.00000003.1445684065.0000000003C71000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1477354145.0000000004841000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004C71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://logincdn.msauth.net/16.000/Converged_v22057_4HqSCTf5FFStBMz0_eIqyA2.css
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004C71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://logincdn.msauth.net/16.000/content/js/ConvergedLoginPaginatedStrings.en-gb_RP-iR89BipE4i7ZOq
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004C71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_tSc0Su-bb7Jt0QVuF6v9Cg2.js
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004C71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://logincdn.msauth.net/shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js
Source: videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marketing.net.occhiali24.it/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://media.goldbetpartners.it/redirect.aspx?
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mediaserver.bwinpartypartners.it/renderBanner.do?
Source: videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest5
Source: videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org/W
Source: videodrv.exe, 00000001.00000003.1454386841.0000000003AF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://msn.com
Source: videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mzl.la/3NS9KJd
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://n26-eu.c2nwa3.net/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nplink.net/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://offerte2019.space/
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004C71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2022-09-17-00-05-23/PreSignInSettingsConfig.json?One
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004C71000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444406864.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1476433531.000000000352F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/PreSignInSettings/Prod/2023-10-05-07-50-22/PreSignInSettingsConfig.json
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004C71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/update100.xml?OneDriveUpdate=d75433bcf1f9312f1975
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004C71000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444521942.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1476511575.000000000352A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/741e3e8c607c445262f3add0e58b18f19e0502af.xml?OneDriveUpdate=ad62f4
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://online.codere.it/promoRedirect?
Source: videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://platform.gadaffiliates.com/
Source: videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://preferredby.me/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://prf.hn/
Source: videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://promonow.shop/offers.php?
Source: videodrv.exe, 00000001.00000003.1444793486.0000000003556000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://r.bing-
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rcl.ink/
Source: videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reactjs.org/docs/error-decoder.html?invariant=
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://record.betpartners.it/
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://repository.luxtrust.lu0
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004919000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/ew-preload-inline-2523c8c1505f1172be19.js
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004919000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/otel-logger-104bffe9378b8041455c.js
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004919000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-35de8a913e.css
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004919000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-async-styles.a903b7d0ab82e5bd2f8a.chunk.v7.css
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004919000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bootstrap-5e7af218e953d095fabf.js
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004919000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bundle-3a99f64809c6780df035.js
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004919000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-bundle-994d8943fc9264e2f8d3.css
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004919000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-fluent~left-nav-rc.ac5cfbeadfd63fc27ffd.chunk.v7.js
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004919000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-forms-group~mru~officeforms-group-forms~officeforms
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004919000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-left-nav-rc.68ab311bcca4f86f9ef5.chunk.v7.js
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004919000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-mru.2ce72562ad7c0ae7059c.chunk.v7.js
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004919000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendor-bundle-ba2888a24179bf152f3d.js
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004919000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendors~left-nav-rc.169ce481376dceef3ef6.chunk.v7.c
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004919000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwa-vendors~left-nav-rc.b24d6b48aeb44c7b5bf6.chunk.v7.j
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004919000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/pwaunauth-9d8bc214ac.css
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004919000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/sharedfontstyles-27fa2598d8.css
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004919000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/sharedscripts-939520eada.js
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004919000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/staticpwascripts-30998bff8f.js
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004919000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://res.cdn.office.net/officehub/bundles/staticstylesfabric-35c34b95e3.css
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004919000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444406864.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1476433531.000000000352F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/hero-image-desktop-f6720a4145.jpg
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004919000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/lockup-mslogo-color-78c06e8898.png
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004919000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/microsoft-365-logo-01d5ecd01a.png
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004919000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/unauth-apps-image-46596a6856.png
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004919000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://res.cdn.office.net/officehub/images/content/images/unauth-checkmark-image-1999f0bf81.png
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004919000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444406864.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1476433531.000000000352F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://res.cdn.office.net/officehub/versionless/officehome/thirdpartynotice.html
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004919000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://res.cdn.office.net/officehub/versionless/webfonts/segoeui_regular.woff2
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004919000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://res.cdn.office.net/officehub/versionless/webfonts/segoeui_semibold.woff2
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rover.ebay.com/
Source: videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sfogliabile.stihlmarketing.it/
Source: videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://snippets.mozilla.com/show/
Source: videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-help
Source: videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes
Source: videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidd.ly/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://track.webgains.com/click.html
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tracker.tradedoubler.com/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tracking.performoney.it/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tracking.tgmfraz.com/
Source: videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://universofree.net/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wellcum.at/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.18carati.com/?acc=
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.aliperme.it/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.it/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.it/shop/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.anrdoezrs.net/click-
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ansa.it/codici-sconto/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.appscommesse.com/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.awin1.com/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.booking.com/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.catawiki.it
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.catcert.net/verarrel
Source: videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.catcert.net/verarrel05
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.centoxcento.net/?track=
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dazn.com/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.it/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.getyourguide.it/
Source: videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/2
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.holyart.it/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.instant-gaming.com/?igr=
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.instant-gaming.com?igr=
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ivacy.com/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.macrolibrarsi.it/
Source: videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: videodrv.exe, 00000001.00000003.1523012493.00000000046F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/(
Source: videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.nigiara.it/scripts/redir.php?url=https://amzn.to/
Source: videodrv.exe, 00000001.00000003.1477354145.0000000004AF9000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org//
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.orgasmi899.com
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.plus500.com/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.primevideo.com/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.rentalcars.com/?affiliateCode=
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.scommettievinci.net/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.trattamentinaturalibio.it/
Source: videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/3
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.worldnomads.com/Turnstile/AffiliateLink?
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.worldnomads.it/?affiliate=
Source: videodrv.exe, 00000001.00000003.1523012493.00000000046F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www2.razer.com/
Source: videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yandex.com

Source: C:\Windows\videodrv.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\4ui8luUSNp.exe

Code function: 0_2_004045FA CreateThread,KillTimer,gethostbyname,CreateThread,CreateThread,CreateThread,PostQuitMessage,NtdllDefWindowProc_A,

0_2_004045FA

Source: C:\Users\user\Desktop\4ui8luUSNp.exe	File created: C:\Windows\videodrv.exe	Jump to behavior
Source: C:\Users\user\Desktop\4ui8luUSNp.exe	File created: C:\Windows\videodrv.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Windows\videodrv.exe	File created: C:\Windows\exe.tmp	Jump to behavior
Source: C:\Windows\videodrv.exe	File created: C:\Windows\zip.tmp	Jump to behavior
Source: C:\Windows\videodrv.exe	File created: C:\Windows\eml.tmp	Jump to behavior

Source: C:\Users\user\Desktop\4ui8luUSNp.exe

Code function: String function: 004058BC appears 45 times

Source: C:\Windows\videodrv.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7544 -s 18336

Source: 4ui8luUSNp.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: classification engine

Classification label: mal100.spyw.evad.mine.winEXE@5/14@72/12

Source: C:\Users\user\Desktop\4ui8luUSNp.exe

Code function: 0_2_004032D7 CLSIDFromString,1001D8F8,CoCreateInstance,1001D8F8,1001D8F8,1001D8F8,1001D8F8,1001D8F8,1001D8F8,1001D8F8,1001D8F8,1001D8F8,1001D8F8,1001D8F8,1001D8F8,1001D8F8,1001D8F8,1001D8F8,1001D8F8,1001D8F8,1001F200,1001F200,

0_2_004032D7

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7544

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\2cffe978-2fca-4897-93b2-25e39ba7b2fe

Jump to behavior

Source: C:\Windows\videodrv.exe

File read: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\4ui8luUSNp.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 4ui8luUSNp.exe

ReversingLabs: Detection: 94%

Source: C:\Users\user\Desktop\4ui8luUSNp.exe

File read: C:\Users\user\Desktop\4ui8luUSNp.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\4ui8luUSNp.exe "C:\Users\user\Desktop\4ui8luUSNp.exe"
Source: C:\Users\user\Desktop\4ui8luUSNp.exe	Process created: C:\Windows\videodrv.exe C:\Windows\videodrv.exe
Source: unknown	Process created: C:\Windows\videodrv.exe "C:\Windows\videodrv.exe"
Source: C:\Windows\videodrv.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7544 -s 18336
Source: C:\Users\user\Desktop\4ui8luUSNp.exe	Process created: C:\Windows\videodrv.exe C:\Windows\videodrv.exe	Jump to behavior

Source: C:\Users\user\Desktop\4ui8luUSNp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ui8luUSNp.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ui8luUSNp.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ui8luUSNp.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ui8luUSNp.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\videodrv.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\videodrv.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\videodrv.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\videodrv.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\videodrv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\videodrv.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\videodrv.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\videodrv.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\videodrv.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\videodrv.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\videodrv.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\videodrv.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\videodrv.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\videodrv.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\videodrv.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\videodrv.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\videodrv.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\videodrv.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\videodrv.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\videodrv.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\videodrv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\videodrv.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\videodrv.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\videodrv.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\videodrv.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\videodrv.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\videodrv.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\videodrv.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\videodrv.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\videodrv.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\videodrv.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\videodrv.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\videodrv.exe	Section loaded: winnsi.dll	Jump to behavior

Source:

Source: C:\Users\user\Desktop\4ui8luUSNp.exe

Code function: 0_2_004043D0 LoadLibraryA,GetProcAddress,WSAStartup,GetWindowsDirectoryA,1001F284,1001F218,DeleteFileA,1001F284,1001F218,DeleteFileA,1001F284,1001F218,DeleteFileA,RegisterClassA,CreateWindowExA,MessageBoxA,SetTimer,TranslateMessage,DispatchMessageA,GetMessageA,

0_2_004043D0

Source: 4ui8luUSNp.exe	Static PE information: section name: UPX2
Source: 4ui8luUSNp.exe	Static PE information: section name: .imports
Source: videodrv.exe.0.dr	Static PE information: section name: UPX2
Source: videodrv.exe.0.dr	Static PE information: section name: .imports

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\Desktop\4ui8luUSNp.exe

Executable created and started: C:\Windows\videodrv.exe

Jump to behavior

Source: C:\Users\user\Desktop\4ui8luUSNp.exe

File created: C:\Windows\videodrv.exe

Jump to dropped file

Source: C:\Users\user\Desktop\4ui8luUSNp.exe

File created: C:\Windows\videodrv.exe

Jump to dropped file

Source: C:\Users\user\Desktop\4ui8luUSNp.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run VideoDriver			Jump to behavior
Source: C:\Users\user\Desktop\4ui8luUSNp.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run VideoDriver			Jump to behavior

Hooking and other Techniques for Hiding and Protection

May modify the system service descriptor table (often done to hook functions)

Source: videodrv.exe, 00000001.00000003.1538006054.00000000046F5000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: KeServiceDescriptorTable

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: videodrv.exe, 00000001.00000003.1441374434.000000000352F000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1436702392.0000000003329000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1462315432.0000000003520000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: DEMUL.EXE

Source: C:\Windows\videodrv.exe	Window / User API: threadDelayed 3431	Jump to behavior
Source: C:\Windows\videodrv.exe	Window / User API: threadDelayed 5901	Jump to behavior
Source: C:\Windows\videodrv.exe	Window / User API: foregroundWindowGot 1769	Jump to behavior

Source: C:\Users\user\Desktop\4ui8luUSNp.exe

API coverage: 5.6 %

Source: C:\Windows\videodrv.exe TID: 7652	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\videodrv.exe TID: 7656	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\videodrv.exe TID: 7888	Thread sleep count: 3431 > 30	Jump to behavior
Source: C:\Windows\videodrv.exe TID: 7888	Thread sleep time: -5146500s >= -30000s	Jump to behavior
Source: C:\Windows\videodrv.exe TID: 7896	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\videodrv.exe TID: 7896	Thread sleep count: 80 > 30	Jump to behavior
Source: C:\Windows\videodrv.exe TID: 7896	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Windows\videodrv.exe TID: 7888	Thread sleep count: 5901 > 30	Jump to behavior
Source: C:\Windows\videodrv.exe TID: 7888	Thread sleep time: -8851500s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\4ui8luUSNp.exe

Code function: 0_2_00402C3E 1001F200,1001F284,1001F284,1001E65C,FindFirstFileA,1001E6C4,1001E6C4,1001E660,1001E65C,1001E65C,1001E660,1001E65C,1001E5C5,FindNextFileA,

0_2_00402C3E

Source: C:\Windows\videodrv.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\videodrv.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\videodrv.exe	Thread delayed: delay time: 60000	Jump to behavior

Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Adobe\	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\	Jump to behavior

Source: videodrv.exe, 00000001.00000003.1452393910.0000000003AF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,1
Source: videodrv.exe, 00000001.00000003.1454070894.0000000003EF7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,1(
Source: videodrv.exe, 00000001.00000003.1515194577.0000000004D2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: https://r.bing.com/rb/18/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=Dx0ma3d6fXRucbIBtQEmpQEmuAE&or=w
Source: 4ui8luUSNp.exe, 00000000.00000002.1375148450.00000000004EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\videodrv.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\4ui8luUSNp.exe

0_2_004043D0

Source: C:\Users\user\Desktop\4ui8luUSNp.exe

Code function: 0_2_00401469 10015765,10015765,100151BB,10015138,1001C489,1001C32C,GetSystemTimeAsFileTime,FileTimeToDosDateTime,1001F200,1001C7EA,1001C7EA,1001F200,1001C7EA,1001C7EA,1001C7EA,1001C7EA,1001F200,1001C7EA,1001C7EA,1001C7EA,1001C4C5,1001BD6D,1001BD6D,

0_2_00401469

Source: videodrv.exe, 00000001.00000003.1441374434.000000000352F000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1436702392.0000000003329000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1462315432.0000000003520000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: acs.exe
Source: videodrv.exe, 00000001.00000003.1441374434.000000000352F000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1436702392.0000000003329000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1462315432.0000000003520000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avp.exe

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\minidumps\prefs.js	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\2918063365piupsah.sqlite	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\Login Data For Account-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir\the-real-index	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\c64980e6-c743-4793-ba4a-89f593d4eb16	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\BudgetDatabase\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\MANIFEST-000001	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\tmp\key4.db	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\first_party_sets.db	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Scripts\CURRENT	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml\YouTube.ico	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Shortcuts	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\trusted_vault.pb	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb\Web Data-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\3561288849sdhlie.sqlite	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\y572q81e.default\profiles.ini	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crashpad\attachments\metadata	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\search.json.mozlz4	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\6786f292-c1be-4996-99cd-77aa855c1844	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Rules\000003.log	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\blob_storage\BrowsingTopicsSiteData	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\59bd13a9-8183-4ac7-8723-9621ae6d3748	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\NetworkDataMigrated	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Scripts\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\7b2ddd96-6d27-491a-a7e0-811ed320f1f0	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\bookmarkbackups\cookies.sqlite-wal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\to-be-removed\webappsstore.sqlite-wal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\to-be-removed\webappsstore.sqlite	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491690340.2824c836-2afd-4a95-940b-ed2b991ba55d.event.jsonlz4	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Code Cache\wasm\index	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\Secure Preferences	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\y572q81e.default\_curlrc	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\CURRENT	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Local Storage\leveldb\Login Data	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache\InterestGroups	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm\Gmail.ico.md5	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\1451318868ntouromlalnodry--epcr.sqlite-wal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\2823318777ntouromlalnodry--naod.sqlite	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\tmp\session-state.json	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\InterestGroups	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\GPUCache\InterestGroups-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\LOG.old	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension State\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\GPUCache\data_0	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\GPUCache\data_1	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\GPUCache\data_2	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\CURRENT	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\GCM Store\Encryption\MANIFEST-000001	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\5e0297e1-aa9b-4634-aaf1-cfd1f718b993	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files\Extension Cookies	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\minidumps\pkcs11.txt	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\6db12043-3902-4d45-8c5d-d992fbf6d4e7	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data\index	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Session Storage\MANIFEST-000001	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Session Storage\CURRENT	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension State\LOG.old	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache\heavy_ad_intervention_opt_out.db-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\db\data.safe.bin	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\ff032c8b-05e6-43c9-9e84-732dbe7aca27	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOG.old	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB\LOG.old	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\3b7fc3d4-90d3-48a3-834f-e61d315e9a5c	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\tmp\favicons.sqlite-wal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG.old	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\GCM Store\Encryption\000003.log	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\Visited Links	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crashpad\reports\settings.dat	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\minidumps\places.sqlite-shm	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore-backups\previous.jsonlz4	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_0	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_2	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\6f70cc77-7837-4f44-9c31-7de59e446d67\BrowsingTopicsState	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\index	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\tmp\handlers.json	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_3	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb\Docs.ico	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\to-be-removed\targeting.snapshot.json	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\GPUCache\data_3	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\TransportSecurity	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Trust Tokens	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\PreferredApps	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\MANIFEST-000001	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Scripts\000003.log	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Top Sites-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Visited Links	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\6f70cc77-7837-4f44-9c31-7de59e446d67\BrowsingTopicsSiteData-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data\data_0	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\2c8e5eea-375d-48a9-ad4c-be583ff1215d	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Reporting and NEL	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\1657114595AmcateirvtiSty.sqlite-wal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\PrivateAggregation	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag\Slides.ico	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13340965317813669	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\History-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\2823318777ntouromlalnodry--naod.sqlite-wal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOG.old	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data\data_3	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data\data_2	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651E6B15-1DD4.pma	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data\data_1	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Reporting and NEL-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\372e391e-787d-40e8-8beb-44106d6c22f4	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Session Storage\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\Top Sites-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\BudgetDatabase\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\NetworkDataMigrated	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Affiliation Database	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695610.18a05d94-e006-440f-b702-3e398a280dbf.health.jsonlz4	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Network Persistent State	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\2824c836-2afd-4a95-940b-ed2b991ba55d	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Session Storage\LOG.old	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000003.log	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\Top Sites	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\MANIFEST-000001	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Rules\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491690337.3be89113-af2b-4b48-9c47-40ac1156f7a2.new-profile.jsonlz4	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\01e461df-d85d-4561-a852-205de2d67f32	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\18a05d94-e006-440f-b702-3e398a280dbf	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak\Google Drive.ico.md5	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\.metadata-v2	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions\Session_13340965342984957	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\3870112724rsegmnoittet-es.sqlite-shm	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\7917ce80-55b3-46ca-99c2-70537bbb959a	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\coupon_db\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions\SharedStorage	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\58b46d46-b146-420f-81af-5b32c19a8aef	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\SharedStorage	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\3870112724rsegmnoittet-es.sqlite	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache\heavy_ad_intervention_opt_out.db	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Trust Tokens-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\security_state\sessionCheckpoints.json	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml\YouTube.ico.md5	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\GCM Store\Encryption\LOG.old	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore-backups\SiteSecurityServiceState.txt	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\GPUCache\History-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Affiliation Database	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension State\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\GPUCache\InterestGroups	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\databases\Databases.db	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Rules\CURRENT	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\hyphen-data\Last Browser	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\e6e57dc0-d354-4d4a-8374-548b8e2bcc5d	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\3561288849sdhlie.sqlite-shm	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf\Sheets.ico	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Sessions\Session_13340965317813669	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\MANIFEST-000001	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651E6B08-3C.pma	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695606.ff032c8b-05e6-43c9-9e84-732dbe7aca27.event.jsonlz4	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\758d1c71-5fff-4193-9977-7a57afa68bf7	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore-backups\sessionstore.jsonlz4	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions\Tabs_13340965343135326	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\to-be-removed\times.json	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\2918063365piupsah.sqlite-shm	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Session Storage\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Secure Preferences	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\blob_storage\BrowsingTopicsState	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\DawnCache\DIPS-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\to-be-removed\xulstore.json	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Rules\LOG.old	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Network Action Predictor	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Sessions\Session_13340965342984957	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions\Tabs_13340965317929160	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Affiliation Database	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\bookmarkbackups\compatibility.ini	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\tmp\extension-preferences.json	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crashpad\metadata	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache\index	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\events\background-update	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_1	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_0	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_3	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\addonStartup.json.lz4	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_2	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension State\000003.log	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\3be89113-af2b-4b48-9c47-40ac1156f7a2	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Trust Tokens	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\GPUCache\heavy_ad_intervention_opt_out.db	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Google Profile.ico	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ShaderCache\index	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\default\ls-archive.sqlite	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\InterestGroups-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm\Gmail.ico	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\Preferences	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb\Docs.ico.md5	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store\LOG.old	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\tmp\favicons.sqlite	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\GCM Store\Encryption\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Preferences	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\000003.log	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\y572q81e.default\times.json	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ShaderCache\data_0	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\MANIFEST-000001	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ShaderCache\data_3	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ShaderCache\data_1	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Trust Tokens-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ShaderCache\data_2	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\databases\Databases.db-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\CURRENT	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\f5c2d345-4cad-4c1a-a51d-15d682036066	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB\LOG.old	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Scripts\LOG.old	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\BrowsingTopicsSiteData	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Rules\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\tmp\ExperimentStoreData.json	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\1451318868ntouromlalnodry--epcr.sqlite-shm	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\DawnCache\DIPS	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\DawnCache\data_3	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Favicons	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\DIPS	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Reporting and NEL-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\to-be-removed\webappsstore.sqlite-shm	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\Login Data	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\PrivateAggregation-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Session Storage\000003.log	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files\Extension Cookies-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_3	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\events\events	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\to-be-removed\storage.sqlite	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\7a27ea16-e265-40c0-823c-0125abf7d855	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\bookmarkbackups\cookies.sqlite-shm	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\DawnCache\data_0	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Scripts\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\DawnCache\data_2	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\DawnCache\data_1	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_2	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\MANIFEST-000001	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\Google Profile.ico	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Secure Preferences	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Network Action Predictor	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\CURRENT	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\CURRENT	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\DIPS-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\minidumps\places.sqlite-wal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Rules\MANIFEST-000001	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\1657114595AmcateirvtiSty.sqlite	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\DawnCache\index	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491690347.6786f292-c1be-4996-99cd-77aa855c1844.first-shutdown.jsonlz4	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\index	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\PrivateAggregation	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\MANIFEST-000001	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Network Action Predictor-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache\History-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak\Google Drive.ico	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\hyphen-data\Local State	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\tmp\favicons.sqlite-shm	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Local Storage\leveldb\Login Data-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Affiliation Database-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651E6B18-1C6C.pma	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\010cab1b-3626-48b5-9d6b-0e4dfe4db5fa	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network Action Predictor	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache\DIPS	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\trusted_vault.pb	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\minidumps\parent.lock	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Code Cache\js\index	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\PrivateAggregation	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651E6B0B-1978.pma	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\7f0194d6-62d6-4174-a7ed-55ebc13aacb4	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\addons.json	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\2b167346-5f76-4c00-8f97-19cee0df0fba	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\bookmarkbackups\cookies.sqlite	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\6260e81e-5ef5-4137-a0a5-7930ea6f0a75	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\edd11145-a3b3-4ebf-ba7b-14b7ec08f19f	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension State\CURRENT	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\MANIFEST-000001	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crashpad\settings.dat	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\bookmarkbackups\cert9.db	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\minidumps\protections.sqlite	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\MANIFEST-000001	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\3870112724rsegmnoittet-es.sqlite-wal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\MANIFEST-000001	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Trust Tokens-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\1657114595AmcateirvtiSty.sqlite-shm	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\CURRENT	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Shortcuts-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695562.2c8e5eea-375d-48a9-ad4c-be583ff1215d.health.jsonlz4	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\minidumps\permissions.sqlite	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Reporting and NEL	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\LOG.old	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\GCM Store\Encryption\Google Profile.ico	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB\LOG.old	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\1451318868ntouromlalnodry--epcr.sqlite	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651E68DC-2698.pma	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache\InterestGroups-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\AlternateServices.txt	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\bookmarkbackups\containers.json	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore-backups\shield-preference-experiments.json	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\CURRENT	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651E6B06-1BF4.pma	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Download Service\Extension Cookies	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\minidumps\places.sqlite	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\coupon_db\LOG.old	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Affiliation Database-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\Shortcuts	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\First Run	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695614.edd11145-a3b3-4ebf-ba7b-14b7ec08f19f.main.jsonlz4	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension State\MANIFEST-000001	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Scripts\MANIFEST-000001	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\2823318777ntouromlalnodry--naod.sqlite-shm	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache\History	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\Login Data-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\Login Data For Account	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache\index	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491690344.6260e81e-5ef5-4137-a0a5-7930ea6f0a75.main.jsonlz4	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\2918063365piupsah.sqlite-wal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb\Web Data	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\GPUCache\History	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store\LOG.old	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf\Sheets.ico.md5	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\054622d9-6ed7-4f25-87fd-b3a9cd668b65	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\12672553-cb8c-4210-ae02-a59c1a541208	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\CURRENT	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag\Slides.ico.md5	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\b3c274f7-6fd8-4832-989b-74a48f86b6b5	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\3561288849sdhlie.sqlite-wal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\GPUCache\index	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Preferences	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ShaderCache\Variations	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG.old	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\6f70cc77-7837-4f44-9c31-7de59e446d67\BrowsingTopicsSiteData	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\hyphen-data\Last Version	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir\the-real-index	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\PreferredApps	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Favicons-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\CURRENT	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\NetworkDataMigrated	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\Shortcuts-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\BrowsingTopicsState	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\6c257ec7-9ee7-4e42-91a6-7d3b50c23b76	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache\DIPS-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\bookmarkbackups\content-prefs.sqlite	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\PreferredApps	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\coupon_db\LOCK	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\GCM Store\Encryption\LOG	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG.old	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\tmp\state.json	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651E6B0E-186C.pma	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Network Action Predictor-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Trust Tokens	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\000003.log	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\PrivateAggregation-journal	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old	Jump to behavior
Source: C:\Windows\videodrv.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 Registry Run Keys / Startup Folder	1 Process Injection	12 Masquerading	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Credential API Hooking	1 Non-Application Layer Protocol	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	21 Virtualization/Sandbox Evasion	1 Credential API Hooking	221 Security Software Discovery	Remote Desktop Protocol	1 Data from Local System	11 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Obfuscated Files or Information	LSA Secrets	3 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	2 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
4ui8luUSNp.exe	95%	ReversingLabs	Win32.Worm.MiMail
4ui8luUSNp.exe	100%	Avira	WORM/Mimail.A1
4ui8luUSNp.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\exe.tmp	100%	Avira	WORM/Mimail.A2
	100%	Avira	WORM/Mimail.A2
C:\Windows\videodrv.exe	100%	Avira	WORM/Mimail.A1
C:\Windows\zip.tmp	100%	Avira	WORM/Mimail.A2
C:\Windows\videodrv.exe	100%	Joe Sandbox ML
C:\Windows\videodrv.exe	95%	ReversingLabs	Win32.Worm.MiMail

Source	Detection	Scanner	Label
http://www.chambersign.org1	0%	URL Reputation	safe
http://repository.swisssign.com/0	0%	URL Reputation	safe
https://deff.nelreports.net/api/report?cat=msn	0%	URL Reputation	safe
http://policy.camerfirma.com0	0%	URL Reputation	safe
http://www.accv.es00	0%	URL Reputation	safe
http://www.firmaprofesional.com/cps0	0%	URL Reputation	safe
http://crl.securetrust.com/SGCA.crl0	0%	URL Reputation	safe
http://www.quovadisglobal.com/cps0	0%	URL Reputation	safe
https://profiler.firefox.com	0%	URL Reputation	safe
https://outlook.live.com/default.aspx?rru=compose&to=%s	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
mylivewallpapers.com	192.124.249.110	true	false	unknown
mail.microsec.hu	193.42.222.38	true	false	unknown
mx2.schule-studium.de	217.13.200.22	true	false	unknown
w0187a3c.kasserver.com	85.13.166.174	true	false	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
outlook-com.olc.protection.outlook.com	52.101.42.5	true	false	unknown
mx00.ionos.de	212.227.15.41	true	false	unknown
mx04.mail.millenniumarts.net	91.198.189.25	true	false	unknown
alt4.gmail-smtp-in.l.google.com	74.125.200.26	true	false	unknown
sk-ee.mail.protection.outlook.com	52.101.73.28	true	false	unknown
pommes.hebbet.de	116.202.20.146	true	false	unknown
aspmx3.googlemail.com	142.251.9.27	true	false	unknown
www.google.com	142.250.184.196	true	false	unknown
smtp.google.com	74.125.206.27	true	false	unknown
googlewatchblog.de	unknown	unknown	false	unknown
wirsiegen.de	unknown	unknown	false	unknown
mozilla.com	unknown	unknown	false	unknown
belgieninfo.net	unknown	unknown	false	unknown
blog.lesoir.be	unknown	unknown	false	unknown
tripadvisor.com	unknown	unknown	false	unknown
trustcentre.co.za	unknown	unknown	false	unknown
catcert.net	unknown	unknown	false	unknown
guenstiger.de	unknown	unknown	false	unknown
google.com	unknown	unknown	false	unknown
mtin.es	unknown	unknown	false	unknown
in.hes.trendmicro.eu	unknown	unknown	false	unknown
games.ch	unknown	unknown	false	unknown
stroeerdigitalgroup.de	unknown	unknown	false	unknown
delamar.de	unknown	unknown	false	unknown
mozilla.org.xpi	unknown	unknown	false	unknown
fanpelis.ac	unknown	unknown	false	unknown
wp.com	unknown	unknown	false	unknown
2x.png	unknown	unknown	false	unknown
time.windows.com	unknown	unknown	false	unknown
ads.talkscreativity.com	unknown	unknown	false	unknown
candidate.hr-manager.net	unknown	unknown	false	unknown
windowspower.de	unknown	unknown	false	unknown
lintorfer.eu	unknown	unknown	false	unknown
search.mozilla.org	unknown	unknown	false	unknown
schule-studium.de	unknown	unknown	false	unknown
chambersign.org	unknown	unknown	false	unknown
gmail.com	unknown	unknown	false	unknown
mozilla.org	unknown	unknown	false	unknown
e-szigno.hu	unknown	unknown	false	unknown
accv.es	unknown	unknown	false	unknown
outlook.com	unknown	unknown	false	unknown
sk.ee	unknown	unknown	false	unknown
radiosantiago.cl	unknown	unknown	false	unknown
garagejournal.com	unknown	unknown	false	unknown
zentrum-der-gesundheit.de	unknown	unknown	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.openh264.org//	videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ads.williamhill.it/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://fp-afd.azurefd.us/apc/trans.gif?a2555e10569a45fe03b885d268c50da9	videodrv.exe, 00000001.00000003.1515194577.0000000004D2B000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.0000000003556000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://display.tracksafe.click/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://basket.mozilla.org/news/subscribe_sms/	videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://link.offerte2019.info/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://mediaserver.bwinpartypartners.it/renderBanner.do?	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://prf.hn/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://sertifikati.ca.posta.rs/crl/PostaCARoot.crl0	videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://iqbroker.com/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://adserver.html.it/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.chambersign.org1	videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://repository.swisssign.com/0	videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.it/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://clkuk.tradedoubler.com/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://aefd.nelreports.net/api/report?cat=bingaotak	videodrv.exe, 00000001.00000003.1476511575.000000000352A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://deff.nelreports.net/api/report?cat=msn	videodrv.exe, 00000001.00000003.1454608483.0000000003EFB000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1510001960.000000000353F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ca2.mtin.es/mtin/crl/MTINAutoridadRaiz0	videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://it.dhgate.com/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://tracker.tradedoubler.com/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ebay.com	videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://screenshots.firefox.com	videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://jooble.org/images/logo_48x61.gif)	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.primevideo.com/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsm	videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ebay.us/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.dazn.com/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://msn.com	videodrv.exe, 00000001.00000003.1454386841.0000000003AF2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://universofree.net/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://group.intesasanpaolo.com/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://pki.registradores.org/normativa/index.htm0	videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://policy.camerfirma.com0	videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://rover.ebay.com/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://casinohex.it/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0?	videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://record.betpartners.it/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.uce.gub.uy/informacion-tecnica/politicas/cp_acrn.pdf0G	videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://firefox.settings.services.mozilla.com/v1i	videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://fpn.firefox.com	videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.scommettievinci.net/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com/policies/privacy/2	videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://clk.tradedoubler.com/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.18carati.com/?acc=	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes	videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.globaltrust.info0	videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://httpslink.com/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.youtube.com/	videodrv.exe, 00000001.00000003.1523012493.00000000046F5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://adv.comunicareimpresa.com/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://preferredby.me/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://r.bing-	videodrv.exe, 00000001.00000003.1444793486.0000000003556000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.anrdoezrs.net/click-	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.worldnomads.it/?affiliate=	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://getpocket.com/	videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsmr	videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ebay.to/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://merino.services.mozilla.com/api/v1/suggest5	videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.centoxcento.net/?track=	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.djpoint.net/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://amazon.com	videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://adv.ilsole24ore.it/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.betwin.co.it	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://firefox-source-docs.mozilla.org/browser/components/newtab/content-src/asrouter/docs/debuggin	videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://promonow.shop/offers.php?	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://tiny.cc/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://aefd.nelreports.net/api/report?cat=bingrms	videodrv.exe, 00000001.00000003.1515194577.0000000004CB3000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1477354145.0000000004529000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000044F1000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.000000000359F000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1515194577.0000000004C8B000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444521942.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.0000000003556000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1445684065.00000000040A1000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1476511575.000000000352A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://firefox.settings.services.mozilla.com/v1i#	videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://certs.oaticerts.com/repository/OATICA2.crl	videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://basket.mozilla.org/subscribe.json	videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://certs.oati.net/repository/OATICA2.crt0	videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.accv.es00	videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://affiliazioniads.snai.it/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://fb.me/use-check-prop-typesG	videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://affiliation.software/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl2.postsignum.cz/crl/psrootqca4.crl01	videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://fb.me/react-polyfillsP	videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://aefd.nelreports.net/api/report?cat=bingth	videodrv.exe, 00000001.00000003.1515194577.0000000004D2B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://affiliazioniads.snai.it/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://fb.me/react-polyfillsO	videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://casinostudio3000.com/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://yandex.com	videodrv.exe, 00000001.00000003.1522131133.00000000046F2000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.inbox.lv/rfc2368/?value=%su	videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.firmaprofesional.com/cps0	videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://platform.gadaffiliates.com/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.securetrust.com/SGCA.crl0	videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.agesic.gub.uy/acrn/acrn.crl0)	videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://clkuk.tradedoubler.com/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ebay.it/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://fp-afd.azurefd.us/apc/trans.gif?69c749c200c753dfb00f5bc8299ab8eb	videodrv.exe, 00000001.00000003.1515194577.0000000004D2B000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.0000000003556000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://snippets.mozilla.com/show/	videodrv.exe, 00000001.00000003.1519219447.00000000046FB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.quovadisglobal.com/cps0	videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://direct.juiceadv.com/aff_	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crazylead.com/video/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://aefd.nel	videodrv.exe, 00000001.00000003.1444521942.0000000003523000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1444793486.0000000003556000.00000004.00000020.00020000.00000000.sdmp, videodrv.exe, 00000001.00000003.1476511575.000000000352A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www2.razer.com/	videodrv.exe, 00000001.00000003.1503640100.0000000003EF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://profiler.firefox.com	videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://outlook.live.com/default.aspx?rru=compose&to=%s	videodrv.exe, 00000001.00000003.1520906615.00000000046F4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://certs.oaticerts.com/repository/OATICA2.crt08	videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://M365CDN.nel.measure.office-92	videodrv.exe, 00000001.00000003.1510393046.000000000354B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cps.chambersign.org/cps/chambersignroot.html0	videodrv.exe, 00000001.00000003.1461418551.0000000003AF1000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
193.42.222.38	mail.microsec.hu	Hungary	34563	MICROSEC-ASHU	false
74.125.200.26	alt4.gmail-smtp-in.l.google.com	United States	15169	GOOGLEUS	false
85.13.166.174	w0187a3c.kasserver.com	Germany	34788	NMM-ASD-02742FriedersdorfHauptstrasse68DE	false
142.251.9.27	aspmx3.googlemail.com	United States	15169	GOOGLEUS	false
74.125.206.27	smtp.google.com	United States	15169	GOOGLEUS	false
52.101.42.5	outlook-com.olc.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
91.198.189.25	mx04.mail.millenniumarts.net	Germany	47692	NESSUSAT	false
52.101.73.28	sk-ee.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
192.124.249.110	mylivewallpapers.com	United States	30148	SUCURI-SECUS	false
212.227.15.41	mx00.ionos.de	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	false
116.202.20.146	pommes.hebbet.de	Germany	24940	HETZNER-ASDE	false
217.13.200.22	mx2.schule-studium.de	Germany	15657	SPEEDBONE-ASDE	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1536323
Start date and time:	2024-10-17 20:01:14 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	4ui8luUSNp.exe renamed because original name is a hash value
Original Sample Name:	5a6beb7ab22fc65258d7d3681ce668058f93b7a2eb534b42b799aa8e61595c08.exe
Detection:	MAL
Classification:	mal100.spyw.evad.mine.winEXE@5/14@72/12
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 4 Number of non-executed functions: 28
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.95.65.251, 20.189.173.20
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, twc.trafficmanager.net, otelrules.afd.azureedge.net, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, pagead2.googlesyndication.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.
VT rate limit hit for: 4ui8luUSNp.exe

Simulations

Behavior and APIs

Time	Type	Description
14:02:29	API Interceptor	8413298x Sleep call for process: videodrv.exe modified
14:03:10	API Interceptor	1x Sleep call for process: WerFault.exe modified
20:02:26	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run VideoDriver C:\Windows\videodrv.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
193.42.222.38	rLJ135TPN7.exe	Get hash	malicious	Unknown	Browse
193.42.222.38	test.exe	Get hash	malicious	Unknown	Browse
192.124.249.110	http://www.nucsoft.com/	Get hash	malicious	Unknown	Browse
212.227.15.41	La60esvnOK.exe	Get hash	malicious	Raccoon SmokeLoader Tofsee Vidar Xmrig	Browse
	RyGaFxV75v.exe	Get hash	malicious	Raccoon RedLine SmokeLoader Tofsee Xmrig	Browse
	kATDFWvtje.exe	Get hash	malicious	Raccoon RedLine SmokeLoader Tofsee Xmrig	Browse
	z5YaDxVg34.exe	Get hash	malicious	Raccoon RedLine SmokeLoader Tofsee Xmrig	Browse
	PD5Aay36rP.exe	Get hash	malicious	Raccoon RedLine Shiotob SmokeLoader Tofsee Xmrig	Browse
52.101.73.28	DPqKF5vqpe.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, Monster Stealer, PureLog Stealer, RedLine, SystemBC	Browse
	EGpGxFlJO8.exe	Get hash	malicious	Glupteba, Mars Stealer, SmokeLoader, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse
	rLJ135TPN7.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.microsec.hu	rLJ135TPN7.exe	Get hash	malicious	Unknown	Browse	193.42.222.38
mail.microsec.hu	test.exe	Get hash	malicious	Unknown	Browse	193.42.222.38
s-part-0017.t-0009.t-msedge.net	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	13.107.246.45
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://oplaesa.krtra.com/c/HEacb57dq4Yf/pNyX	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Vidar	Browse	13.107.246.45
	https://enkonooh.com/n/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9Ym1RNFV6RT0mdWlkPVVTRVIxMDEwMjAyNFUyMTEwMTAyNw==#	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	xkIF42iMFB.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	RuOufbwKA4.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	cWUHvDMook.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://cnn.compromisedblog.com/XSTc5bEY5TVlBdTVyb1pVN0hFNzRzNW9PLzZnLzZxbzBqeUt5RTBtTFUzNjczOGNsMlB3NURuWjF2cStpdXN2ZmYzWUI3TVZGWWtqcFlEem9nNlUvTHJCeEZ0VTZ2SzFDN2dEd2Zxb0FUOHFmUHR3UjJZMURHOEhveUd6TThqUnhvTVhpbURLMndDemhZY3FteFBZKzZwWmpMV2x3aUJWdzRGZG5IdkdIRnhoTmRTdnZlNE1IUHBCZTdnPT0tLXNnRktmT2VjaXgyVExmS1MtLTFRRWd4cnRWcS9ZQzljNE53S2tBdEE9PQ==?cid=2231760484%3E%20%5Bhttps://cnn.compromisedblog.com/XYmtrY2hhSzZlK09tNXhxSGoxMW1vSjFJdDVrN1N5eUxwQW9WcG9uL2V0NVRyUDhZenRQUWFpcUVhREJWVDV2Uk1FOVZEejMyN0llRU5WRHVvU2Z3eTAyY1NaLzNyS2VCaWdHcWJrRXFWUGdGNVpHbU9ZTUllQT09LS0wQmJWUGFlMUwwMDlHQjJhLS1rbmRxUmNwNVFZSHg3ajFPRVR2Z2dBPT0=?cid=2231760484	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
outlook-com.olc.protection.outlook.com	.exe	Get hash	malicious	Unknown	Browse	52.101.9.4
	sorteado!!.com.exe	Get hash	malicious	Unknown	Browse	52.101.132.31
	Message.scr.exe	Get hash	malicious	MyDoom	Browse	104.47.51.33
	webcam.txt.com.exe	Get hash	malicious	Unknown	Browse	52.101.73.10
	Transcript.exe	Get hash	malicious	MyDoom	Browse	104.47.17.97
	gEkl9O5tiu.exe	Get hash	malicious	Phorpiex	Browse	104.47.66.33
	64434c8c20fe4b64041795ac2a1472662fa5d33fa0cbb.exe	Get hash	malicious	Raccoon RedLine SmokeLoader Tofsee Vidar Xmrig	Browse	104.47.55.33
	HsWJJz7nq4.exe	Get hash	malicious	Tofsee Xmrig	Browse	104.47.22.161
	z5YaDxVg34.exe	Get hash	malicious	Raccoon RedLine SmokeLoader Tofsee Xmrig	Browse	104.47.66.33
	ABhHk2dXUE.exe	Get hash	malicious	Raccoon RedLine SmokeLoader Tofsee Xmrig	Browse	104.47.13.33
mx00.ionos.de	b2bXo6vmDm.exe	Get hash	malicious	SystemBC	Browse	212.227.15.41
	5CxmQXL0LD.exe	Get hash	malicious	SystemBC	Browse	212.227.15.41
	yq5xNPpWCT.exe	Get hash	malicious	PureLog Stealer, SystemBC	Browse	212.227.15.41
	TL6bE5Uq4y.exe	Get hash	malicious	PureLog Stealer, SystemBC	Browse	212.227.15.41
	cbIcBAgY5W.exe	Get hash	malicious	SystemBC	Browse	212.227.15.41
	td2RgV6HyP.exe	Get hash	malicious	SystemBC	Browse	212.227.15.41
	file.exe	Get hash	malicious	SystemBC	Browse	212.227.15.41
	vm6XYZzWOd.exe	Get hash	malicious	PureLog Stealer, SystemBC	Browse	212.227.15.41
	z8s945rPmZ.exe	Get hash	malicious	SystemBC	Browse	212.227.15.41
	mrPTE618YB.exe	Get hash	malicious	PureLog Stealer	Browse	212.227.15.41

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NMM-ASD-02742FriedersdorfHauptstrasse68DE	Request For PO-230102.bat.exe	Get hash	malicious	FormBook	Browse	85.13.166.18
	https://allegro-worxx.de/	Get hash	malicious	Unknown	Browse	85.13.161.130
	https://atpscan.global.hornetsecurity.com/?d=48cXMF0z7lMlWaR4-PlsbtUc8mFiMfFFndJRjEPuYtN-uYwWsyWxL5J5MR-Ug5CE&f=dme3IKUCx1CkAEFqHg7DwPw18BP_OQlvudnvuL33-Lpo64IRdbltM4_7BbS22Zf4&i=&k=uvEU&m=C-1BZKEYF-Cl5rwq0_FrWo_rnOtg9J2VjL7wG_KiYQ4zCmrhfgeCWZm7jI2FLiWiujyVfZXhjPSaNszUHd_-tPPbHZVMqnN_KxIKzjHidCoVjgDEgxtyWq50QMIznX31&n=msheiBXClL42beZAq-0MKeu_K3YWbf4RbFSWB4nMvrZjKHZvlfgqWpnAMmHJM8nOBGwYdLcEaXDrA0ElMeqJyA&r=qQoQsacw6FZ-pWCR9Ygk8d_uohNhiBjvfkDS9IBTRytjYPkbqiDbNjzjfMkGfqGW&s=c3334c9337ad200a046268dabfc48b0b462d8959b1985605036142fc4b1a8f81&u=https%3A%2F%2Fmqqaqm.clicks.mlsend.com%2Ftb%2Fc%2FeyJ2Ijoie1wiYVwiOjEwNjMxNTQsXCJsXCI6MTMxNjM1NDA2NzI2NzU5NjE3LFwiclwiOjEzMTYzNTQwNjk1MTE1NTExNX0iLCJzIjoiMWU0NDhhM2JiYjBjYmJmOSJ9	Get hash	malicious	Unknown	Browse	85.13.157.247
	https://immergut.dotling.com	Get hash	malicious	Unknown	Browse	85.13.165.204
	firmware.armv4l.elf	Get hash	malicious	Unknown	Browse	85.13.147.130
	firmware.armv5l.elf	Get hash	malicious	Unknown	Browse	85.13.147.130
	firmware.mipsel.elf	Get hash	malicious	Unknown	Browse	85.13.139.4
	220204-TF1--00.exe	Get hash	malicious	FormBook	Browse	85.13.151.9
	http://arianarings.com	Get hash	malicious	Unknown	Browse	85.13.154.44
	Copy of 01. Bill of Material - 705.exe	Get hash	malicious	FormBook	Browse	85.13.151.9
MICROSOFT-CORP-MSN-AS-BLOCKUS	botnet.mips.elf	Get hash	malicious	Mirai, Moobot	Browse	20.79.222.248
	botnet.arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	20.103.244.107
	https://enkonooh.com/n/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9Ym1RNFV6RT0mdWlkPVVTRVIxMDEwMjAyNFUyMTEwMTAyNw==#	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.60
	phish_alert_iocp_v1.4.48.eml	Get hash	malicious	Unknown	Browse	52.113.194.132
	https://tmprod10067889ext.b2clogin.us/tmprod10067889ext.onmicrosoft.us/B2C_1A_Customer_Signup_Invitation/oauth2/v2.0/authorize?client_id=a852dfcc-b0c0-4774-9f4f-ad8c29e1a735&nonce=af9ba7a9-72c6-4409-839a-ac38ce970f76&redirect_uri=https%3A%2F%2Fconnect.irs.gov%2Fsystem%2Ftemplates%2Fchat%2Fcustom%2Fvascripts%2Fregistration.html&scope=openid&response_type=id_token&id_token_hint=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJhdWQiOiJhODUyZGZjYy1iMGMwLTQ3NzQtOWY0Zi1hZDhjMjllMWE3MzUiLCJwcm9kdWN0VGVtcGxhdGUiOiJlZ2FpbiIsIm5iZiI6MTcyOTE0OTQxMywic3VyTmFtZSI6IlNjaHJvdGUiLCJnaXZlbk5hbWUiOiJNaWNoZWxsZSIsImlzcyI6Imh0dHBzOi8vY29ubmVjdC5pcnMuZ292IiwiZXhwIjoxNzI5NDA4NjEzLCJlbWFpbCI6Im1zY2hyb3RlQGNyZ292LmNvbSJ9.e0KO2_wTMkdSNqm7Vpm55VA0OP7vuzA-LcvWOwe6XspWjWkqHMIRJZiE57gdM0JyU4olxr9w4tMQBKcpLGFOiOZv1oawaBoXV5AidV_aegc3vd2IYUuq2bVMGK7iF_Skv8VodKQndviPUmlWfzEzc-kV_u2b1hta5LNfX9B_xK65vtf1Zh4Y1rOkW5Ruv-Spe-8zOUIOeWgA9vuX00d1_Nuz5HNdfReQ3sxfQsyay5TmfYDvAh72menDTDmKRD_0GJDw7dWWkCYakTh-fjzkq39MwapVY3U0zbjhnxoW89VKaOF9GQFRYoNlLU9DHRWgznC-GkAdIU8mswVlGkkLng	Get hash	malicious	Unknown	Browse	20.140.151.75
	botnet.arm.elf	Get hash	malicious	Mirai, Moobot	Browse	52.101.106.133
	powerpc.elf	Get hash	malicious	Unknown	Browse	20.233.3.132
	ppc.elf	Get hash	malicious	Mirai	Browse	20.216.184.136
	arm5.elf	Get hash	malicious	Mirai	Browse	22.134.24.77
	https://cnn.compromisedblog.com/XSTc5bEY5TVlBdTVyb1pVN0hFNzRzNW9PLzZnLzZxbzBqeUt5RTBtTFUzNjczOGNsMlB3NURuWjF2cStpdXN2ZmYzWUI3TVZGWWtqcFlEem9nNlUvTHJCeEZ0VTZ2SzFDN2dEd2Zxb0FUOHFmUHR3UjJZMURHOEhveUd6TThqUnhvTVhpbURLMndDemhZY3FteFBZKzZwWmpMV2x3aUJWdzRGZG5IdkdIRnhoTmRTdnZlNE1IUHBCZTdnPT0tLXNnRktmT2VjaXgyVExmS1MtLTFRRWd4cnRWcS9ZQzljNE53S2tBdEE9PQ==?cid=2231760484%3E%20%5Bhttps://cnn.compromisedblog.com/XYmtrY2hhSzZlK09tNXhxSGoxMW1vSjFJdDVrN1N5eUxwQW9WcG9uL2V0NVRyUDhZenRQUWFpcUVhREJWVDV2Uk1FOVZEejMyN0llRU5WRHVvU2Z3eTAyY1NaLzNyS2VCaWdHcWJrRXFWUGdGNVpHbU9ZTUllQT09LS0wQmJWUGFlMUwwMDlHQjJhLS1rbmRxUmNwNVFZSHg3ajFPRVR2Z2dBPT0=?cid=2231760484	Get hash	malicious	HTMLPhisher	Browse	13.107.253.45
NESSUSAT	SecuriteInfo.com.Linux.Siggen.9999.16227.30183.elf	Get hash	malicious	Mirai	Browse	212.232.24.241
	7GfciIf7ys.exe	Get hash	malicious	Unknown	Browse	84.242.14.245
	83DBFB03FD23DCE6316D62B66750D055CA7DF4A9DB5BB51DD3C5545EA8F40BB6.exe	Get hash	malicious	Bdaejec, Vidar	Browse	146.255.56.83
	PoksxEQkb8.elf	Get hash	malicious	Unknown	Browse	212.232.24.224
	c5018a3915e8a9de41e083f7936c2d232b9a73ba41c8c07fb7b2d90d5f5d8e8e_dump.exe	Get hash	malicious	SystemBC	Browse	77.244.243.38
	ZJgGk9RNIE.elf	Get hash	malicious	Mirai, Moobot	Browse	185.205.80.173
	6A9jBmgfEz.elf	Get hash	malicious	Mirai	Browse	83.137.116.204
	4se90AvJtT.elf	Get hash	malicious	Mirai	Browse	212.232.24.215
	L4qsAy3vf5.elf	Get hash	malicious	Unknown	Browse	212.232.24.236
	OneDrive_2023-08-03.zip	Get hash	malicious	Unknown	Browse	83.137.118.21
MICROSEC-ASHU	rLJ135TPN7.exe	Get hash	malicious	Unknown	Browse	193.42.222.38
MICROSEC-ASHU	test.exe	Get hash	malicious	Unknown	Browse	193.42.222.38
MICROSOFT-CORP-MSN-AS-BLOCKUS	botnet.mips.elf	Get hash	malicious	Mirai, Moobot	Browse	20.79.222.248
	botnet.arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	20.103.244.107
	https://enkonooh.com/n/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9Ym1RNFV6RT0mdWlkPVVTRVIxMDEwMjAyNFUyMTEwMTAyNw==#	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.60
	phish_alert_iocp_v1.4.48.eml	Get hash	malicious	Unknown	Browse	52.113.194.132
	https://tmprod10067889ext.b2clogin.us/tmprod10067889ext.onmicrosoft.us/B2C_1A_Customer_Signup_Invitation/oauth2/v2.0/authorize?client_id=a852dfcc-b0c0-4774-9f4f-ad8c29e1a735&nonce=af9ba7a9-72c6-4409-839a-ac38ce970f76&redirect_uri=https%3A%2F%2Fconnect.irs.gov%2Fsystem%2Ftemplates%2Fchat%2Fcustom%2Fvascripts%2Fregistration.html&scope=openid&response_type=id_token&id_token_hint=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJhdWQiOiJhODUyZGZjYy1iMGMwLTQ3NzQtOWY0Zi1hZDhjMjllMWE3MzUiLCJwcm9kdWN0VGVtcGxhdGUiOiJlZ2FpbiIsIm5iZiI6MTcyOTE0OTQxMywic3VyTmFtZSI6IlNjaHJvdGUiLCJnaXZlbk5hbWUiOiJNaWNoZWxsZSIsImlzcyI6Imh0dHBzOi8vY29ubmVjdC5pcnMuZ292IiwiZXhwIjoxNzI5NDA4NjEzLCJlbWFpbCI6Im1zY2hyb3RlQGNyZ292LmNvbSJ9.e0KO2_wTMkdSNqm7Vpm55VA0OP7vuzA-LcvWOwe6XspWjWkqHMIRJZiE57gdM0JyU4olxr9w4tMQBKcpLGFOiOZv1oawaBoXV5AidV_aegc3vd2IYUuq2bVMGK7iF_Skv8VodKQndviPUmlWfzEzc-kV_u2b1hta5LNfX9B_xK65vtf1Zh4Y1rOkW5Ruv-Spe-8zOUIOeWgA9vuX00d1_Nuz5HNdfReQ3sxfQsyay5TmfYDvAh72menDTDmKRD_0GJDw7dWWkCYakTh-fjzkq39MwapVY3U0zbjhnxoW89VKaOF9GQFRYoNlLU9DHRWgznC-GkAdIU8mswVlGkkLng	Get hash	malicious	Unknown	Browse	20.140.151.75
	botnet.arm.elf	Get hash	malicious	Mirai, Moobot	Browse	52.101.106.133
	powerpc.elf	Get hash	malicious	Unknown	Browse	20.233.3.132
	ppc.elf	Get hash	malicious	Mirai	Browse	20.216.184.136
	arm5.elf	Get hash	malicious	Mirai	Browse	22.134.24.77
	https://cnn.compromisedblog.com/XSTc5bEY5TVlBdTVyb1pVN0hFNzRzNW9PLzZnLzZxbzBqeUt5RTBtTFUzNjczOGNsMlB3NURuWjF2cStpdXN2ZmYzWUI3TVZGWWtqcFlEem9nNlUvTHJCeEZ0VTZ2SzFDN2dEd2Zxb0FUOHFmUHR3UjJZMURHOEhveUd6TThqUnhvTVhpbURLMndDemhZY3FteFBZKzZwWmpMV2x3aUJWdzRGZG5IdkdIRnhoTmRTdnZlNE1IUHBCZTdnPT0tLXNnRktmT2VjaXgyVExmS1MtLTFRRWd4cnRWcS9ZQzljNE53S2tBdEE9PQ==?cid=2231760484%3E%20%5Bhttps://cnn.compromisedblog.com/XYmtrY2hhSzZlK09tNXhxSGoxMW1vSjFJdDVrN1N5eUxwQW9WcG9uL2V0NVRyUDhZenRQUWFpcUVhREJWVDV2Uk1FOVZEejMyN0llRU5WRHVvU2Z3eTAyY1NaLzNyS2VCaWdHcWJrRXFWUGdGNVpHbU9ZTUllQT09LS0wQmJWUGFlMUwwMDlHQjJhLS1rbmRxUmNwNVFZSHg3ajFPRVR2Z2dBPT0=?cid=2231760484	Get hash	malicious	HTMLPhisher	Browse	13.107.253.45

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_videodrv.exe_f6d8b9a778a7455c8af830ba75e9f121b7a76916_a33d36b7_b724bf6b-3898-4295-887d-e3592b506ab1\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8753629616564877
Encrypted:	false
SSDEEP:	96:DZ4F3chgsshvoI7JfGQXIDcQvc6QcEVcw3cE/OHu+HbHg/oJAnQ4OZU6+yA0Trh/:W6hgn0BU/wjJWdKWzuiFtZ24IO89
MD5:	1A85F078D2AE9B02FCFC031F58CCAD48
SHA1:	BFC1304D966CEAC13BD917F181066CCA0621C390
SHA-256:	6975932120AE9840C7519EC40B6E9AB4D5B4F222160EA3324EB92CBFD321BE6F
SHA-512:	61C0E8560E4EFE7BA913513CF075E95071EF6947D75E346355A31DD90100851BC0332AF827680F9317DD01B80802FA71BF56DB9B83567BFC8D7191866B2B2E68
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.3.6.6.1.7.6.3.7.4.5.8.2.6.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.3.6.6.1.7.6.4.5.7.3.9.5.5.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.7.2.4.b.f.6.b.-.3.8.9.8.-.4.2.9.5.-.8.8.7.d.-.e.3.5.9.2.b.5.0.6.a.b.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.5.8.7.5.c.e.0.-.1.7.c.b.-.4.9.9.c.-.8.3.1.3.-.5.e.1.a.e.8.5.4.e.3.b.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.v.i.d.e.o.d.r.v...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.7.8.-.0.0.0.1.-.0.0.1.4.-.7.b.9.7.-.3.8.b.8.b.e.2.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.9.6.b.a.0.9.9.a.e.c.1.2.4.d.2.1.8.b.4.c.2.2.9.0.d.c.a.3.1.8.4.0.0.0.0.f.f.f.f.!.0.0.0.0.9.5.d.e.b.7.c.1.d.c.f.b.a.5.1.4.4.1.0.0.a.5.d.7.3.c.b.2.5.2.1.8.f.3.0.4.e.3.f.4.!.v.i.d.e.o.d.r.v...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREDB9.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Oct 17 18:02:44 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	392436
Entropy (8bit):	2.152608618388878
Encrypted:	false
SSDEEP:	1536:VC02UZp6vgvqzBTuSEpodyQj4cD7QMNmC3ekWuWHG/y+wcT/1:V9pp6vDtTuSEodT7T3Xn
MD5:	EEE024D618BC61F7FC32B5BD9D905028
SHA1:	667A28CF28BED527E09F149FC608B1777F6D70B1
SHA-256:	5D05045AF127329761043B7FEAB22456B3AA61880AA3E042F5F59C9CED7C69B8
SHA-512:	AC85260F90BB313D129E13A29E67D738CBF1930108CF445D4C77400B1C7E0CCE0D6AEDCCCC7FCACC96CDA0FF1EB7C25FB5F150C1510AFCD94EE5CDE4CECBC21D
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......DQ.g........................P................Q..........T.......8...........T...............$3..........\...........H...............................................................................eJ..............GenuineIntel............T.......x...0Q.g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREF6F.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6358
Entropy (8bit):	3.7261312052152245
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbKx6WQ/lYEiQE/Wec5aM4Ue89bSIsfuvnGm:R6l7wVeJKx6hlYF0pre89bSIsfuvGm
MD5:	D7C4F89E8D8D130855FC04A195D53602
SHA1:	3D6D76EBA58A9D5766B1A7146591B406E24356DA
SHA-256:	6349B27D68803E459465603015F1B988906E36D80E39592D4A0F088F05986CA6
SHA-512:	93581F2321DF97C6965C10321B7C3BE929D46C7985EF25CCD300098EC50AFE60FD135D745C91743CEF3F1086C5CC0A6CE2B073754450F6D4923EAEC15C9520BA
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREFAF.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4609
Entropy (8bit):	4.475206767950848
Encrypted:	false
SSDEEP:	48:cvIwWl8zsnuJg77aI9mJWpW8VY5RYm8M4J4txFQ+q8eD9L6uSad:uIjfnkI7o47VPJ9VLVSad
MD5:	99409EB27F0B8D9051782A3B0CE39CA2
SHA1:	4568EAC3A44B08F42C854A8FB60130C7E84EF87A
SHA-256:	C858AE150E208510A8DA3453FA51271AAF72E106D29F7269B61D32CE998ED96F
SHA-512:	4FC952D66F4FF63DF32EE11F149FB6FC59F85FAC2404CB64A02B81FE4E72184015C6FFA071F3E98E832E45C58636675DE2030D42EFFA7E5E171FAF161159A081
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="547745" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\VirtualStore\Windows\eml.tmp

Download File

Process:	C:\Windows\videodrv.exe
File Type:	ASCII text
Category:	modified
Size (bytes):	7828
Entropy (8bit):	4.9250736129808566
Encrypted:	false
SSDEEP:	192:85/QgybyCgu5/Qgyby6H3gOT5Ag9VzlzFYFlatq:7yCg1y6H3g89yFH
MD5:	CB3F751F436F9C49840EA27D919613D2
SHA1:	C4E39B4E662D285AB62D41B72637918682C80517
SHA-256:	79218CF37A860B577D7AD94390B7BCEC9713EC2BEDF21D394EBB06BDF66E152B
SHA-512:	F209DD3F256FAB8FDAB517C1A139C750AC43BD80A1572C299F710D9B0D08353D440369E55B39BBAA5154A9C6A465A83FDE24D241E5F27FA61B7B1FBE99F03597
Malicious:	false
Reputation:	low
Preview:	formautofill@mozilla.org.google@search.mozilla.org.pictureinpicture@mozilla.org.screenshots@mozilla.org.webcompat@mozilla.org.addons-search-detection@mozilla.com.default-theme@mozilla.org.bing@search.mozilla.org.amazondotcom@search.mozilla.org.ddg@search.mozilla.org.wikipedia@search.mozilla.org.docs-hosted-app-own@google.com.ocsp.digicert.com.acrobat_reader2020_32@2x.png.shoprunnernotsignedin@outlook.com.shopping.edge.test@gmail.com.pkiadmin@trustcentre.co.za.accv@accv.es.admin_ca@mtin.es.pki@sk.ee.info@e-szigno.hu.ec_acc@catcert.net.chambersroot@chambersign.org.chambersignroot@chambersign.org.DPCacraiz.pdf.R@garagejournal.com.R@tripadvisor.com.R@mylivewallpapers.com.R@candidate.hr-manager.net.R@pagead2.googlesyndication.com.R@ads.talkscreativity.com.R@belgieninfo.net.R@delamar.de.R@googlewatchblog.de.R@lintorfer.eu.R@schule-studium.de.R@windowspower.de.R@wirsiegen.de.R@wp.com.R@games.ch.R@guenstiger.de.R@zentrum-der-gesundheit.de.R@stroeerdigitalgroup.de.R@radiosantiago.cl.R@fanpelis.

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.416582319867543
Encrypted:	false
SSDEEP:	6144:Scifpi6ceLPL9skLmb0moSWSPtaJG8nAgex285i2MMhA20X4WABlGuNa5+:/i58oSWIZBk2MM6AFBgo
MD5:	02508E8A0E14EB32CBB1390B3F6E8D7F
SHA1:	10E347BFEC68385B195C51681BBAF29A2B4E30D6
SHA-256:	0D3BB1B1AAF04A25D7E62B03DFCD883985754AEC7F7BCCA3361D3E2301D71F20
SHA-512:	0076AAE7DB2B6C6EE8F699EDEBBB4F631AB2E3563A4CCFD91D6C4066C3FBCA841FF3ECDF00D691DD51053C4ED114AAE67F8E1972F351B554754DE6784DAF46B1
Malicious:	false
Reputation:	low
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmN... ..............................................................................................................................................................................................................................................................................................................................................Vz..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\eml.tmp

Download File

Process:	C:\Windows\videodrv.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	3.603856189774724
Encrypted:	false
SSDEEP:	3:QIycJlIEIQMs:QI3cEpz
MD5:	B511CEF61B06D799D0F51076F090D6B4
SHA1:	C61B6E78927110D1F363CC0CFD913C548B99A671
SHA-256:	D30E3373298922DBC2FAABE665E935B0D58129CD24190125E2A4C5C1DCC12E42
SHA-512:	509F4DF0435A37DA8A61D490362A30207ED4F4AEB678E9EAFE9B2F76BD60C419F44D787A358C859068978E94CC084AA84BE8C984CD9D10A405454076FAD03F20
Malicious:	false
Reputation:	low
Preview:	formautofill@mozilla.org.

C:\Windows\exe.tmp

Download File

Process:	C:\Windows\videodrv.exe
File Type:	data
Category:	dropped
Size (bytes):	527253
Entropy (8bit):	1.375817240820474
Encrypted:	false
SSDEEP:	1536:uudiUvlSARwjdYLX2hsEQfjdYa2hsEQfjdYH:WKlSEwjuLXdjuadjuH
MD5:	19AC94EF8AEE16FE7996EF16C353E76E
SHA1:	812D318F19DA4179D496FA935947CB8D06659B2C
SHA-256:	0CBECA5538A82505501B5E93AE427BB9782911652C0EDF86B19BECC11BAABC2D
SHA-512:	AAD70786934258453B5E8070F2AFEB342952E7692884A06292B61172852BA1A15C5F7BA78CD4D2CD37B9E934A16870E314EA8629C246C7AC19866D177F8FD4CB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	low
Preview:	MIME-Version: 1.0.Content-Location:File://foo.exe.Content-Transfer-Encoding: binary..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......?...............7.0.......@.......P........@.................................................................................................................................................................................................UPX0.....@.......>......................UPX1.....0...P...*...B..............@...UPX2.................l..............@....imports.............p..............@..............................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\videodrv.exe

Download File

Process:	C:\Users\user\Desktop\4ui8luUSNp.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	526632
Entropy (8bit):	1.3659614853988677
Encrypted:	false
SSDEEP:	1536:DudiUvlSARwjdYLX2hsEQfjdYa2hsEQfjdYB:JKlSEwjuLXdjuadjuB
MD5:	267B10ECA642BBC3534BE32CBC565F35
SHA1:	95DEB7C1DCFBA5144100A5D73CB25218F304E3F4
SHA-256:	5A6BEB7AB22FC65258D7D3681CE668058F93B7A2EB534B42B799AA8E61595C08
SHA-512:	8D57C6B99286D93E7328D99A609DCC2C93E0FC00467F8D48CEF1FFEE61CF882F5657DDE35309CFBD3B8B4D6AD6461B44BE6BB9109A4701365569BECA9F8DB23F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 95%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......?...............7.0.......@.......P........@.................................................................................................................................................................................................UPX0.....@.......>......................UPX1.....0...P...*...B..............@...UPX2.................l..............@....imports.............p..............@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\videodrv.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\4ui8luUSNp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\zip.tmp

Download File

Process:	C:\Windows\videodrv.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1049508
Entropy (8bit):	1.338104184779259
Encrypted:	false
SSDEEP:	3072:fKlSEwjuLXdjuadju2KlSEwjuLXdjuadjuu:ct+t3
MD5:	DBA503531EE7004D2DD2094B75B3500E
SHA1:	9433458D2BF72A07201728FAC938264F3B42DDBE
SHA-256:	EFC7A0410C3297E030D3BBED9D8513C6939ABAE769C4CFBBD3443D610202442E
SHA-512:	4D6099818CA7DC241F111DBF812335450F0687FC6F9AA9D70B1AA321EA53C6D9952ABBB04AFEF52E912E54E24914EA3D178FC788AC5D83B2A04A0F4A6C20D23E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	PK........R.QY.............message.htmlMIME-Version: 1.0.Content-Location:File://foo.exe.Content-Transfer-Encoding: binary..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......?...............7.0.......@.......P........@.................................................................................................................................................................................................UPX0.....@.......>......................UPX1.....0...P...*...B..............@...UPX2.................l..............@....imports.............p..............@....................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Entropy (8bit):	1.3659614853988677
TrID:	Win32 Executable (generic) a (10002005/4) 99.37% UPX compressed Win32 Executable (30571/9) 0.30% Win32 EXE Yoda's Crypter (26571/9) 0.26% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	4ui8luUSNp.exe
File size:	526'632 bytes
MD5:	267b10eca642bbc3534be32cbc565f35
SHA1:	95deb7c1dcfba5144100a5d73cb25218f304e3f4
SHA256:	5a6beb7ab22fc65258d7d3681ce668058f93b7a2eb534b42b799aa8e61595c08
SHA512:	8d57c6b99286d93e7328d99a609dcc2c93e0fc00467f8d48cef1ffee61cf882f5657dde35309cfbd3b8b4d6ad6461b44be6bb9109a4701365569beca9f8db23f
SSDEEP:	1536:DudiUvlSARwjdYLX2hsEQfjdYa2hsEQfjdYB:JKlSEwjuLXdjuadjuB
TLSH:	88B46C035D003E4FC5C2A23173B5F77EAC72D6A0893B6411670C0A76689C66A976EBDF
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......?...............7.0.......@.......P........@........................................................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4011cb
Entrypoint Section:	UPX0
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x3FA39DA8 [Sat Nov 1 11:48:56 2003 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	1
OS Version Minor:	0
File Version Major:	1
File Version Minor:	0
Subsystem Version Major:	1
Subsystem Version Minor:	0
Import Hash:	fa3aa9322a0f65f92ba29e31c596f379

Entrypoint Preview

Instruction
mov eax, dword ptr fs:[00000000h]
push ebp
mov ebp, esp
push FFFFFFFFh
push 0047401Ch
push 0040109Ah
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 10h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
push eax
fstcw word ptr [esp]
or word ptr [esp], 0300h
fldcw word ptr [esp]
add esp, 04h
push 00000000h
push 00000000h
push 00474028h
push 00474024h
push 00474020h
call 00007FA4386AE5C4h
push dword ptr [00474028h]
push dword ptr [00474024h]
push dword ptr [00474020h]
mov dword ptr [00474014h], esp
call 00007FA4386AE313h
add esp, 18h
xor ecx, ecx
mov dword ptr [ebp-04h], ecx
push eax
call 00007FA4386AE5A5h
leave
ret
add byte ptr [eax], al
mov dword ptr fs:[00000000h], eax
ret
add bh, al
add eax, 00469EE0h
add byte ptr [eax], al
add byte ptr [eax], al
mov dword ptr [00473EE4h], 00000000h
call 00007FA4386AA0BDh
ret
push ebp
mov ebp, esp
push ecx
push eax
push esi
push edi
push dword ptr [ebp+08h]
call 00007FA4386AE648h
add esp, 04h
mov esi, dword ptr [ebp+08h]
lea edi, dword ptr [eax+esi-03h]
mov dword ptr [ebp-08h], edi
push 00000003h
push 00474D96h
push dword ptr [ebp-08h]
call 00007FA4386AE644h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x79000	0xc8	.imports
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x74000	0x73e00	ca42adacd995b18ca19d76272ee8842a	False	0.024733262540453074	data	0.4619326821157285	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x75000	0x3000	0x2a00	b926594d85dd43cfac869e52e27f250a	False	0.5935639880952381	data	5.771304382344444	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX2	0x78000	0x1000	0x400	2bcdb781fb93ed2f4fcd058ccd1e6f47	False	0.2890625	data	2.4579807562741762	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.imports	0x79000	0x1000	0x600	fb27afeec80f9f41d22e6dcda522e610	False	0.4720052083333333	data	4.385977710973273	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
KERNEL32.DLL	FileTimeToDosDateTime, FindFirstFileA, FindNextFileA, FormatMessageA, GetCommandLineA, GetFileSize, GetModuleHandleA, CloseHandle, GetProcAddress, GetSystemTimeAsFileTime, GetTickCount, GetWindowsDirectoryA, CopyFileA, LoadLibraryA, CreateFileA, ReadFile, RtlUnwind, RtlZeroMemory, Sleep, TerminateThread, WinExec, CreateThread, DeleteFileA
ADVAPI32.DLL	RegEnumValueA, RegCloseKey, RegOpenKeyA, RegSetValueExA
CRTDLL.DLL	_filelength, _fileno, __GetMainArgs, exit, fclose, fgets, fopen, fprintf, fread, free, fwrite, malloc, memcpy, printf, raise, signal, sprintf, strcat, strchr, strcmp, strcpy, strlen, strncat, strncmp, strncpy
GDI32.DLL	GetStockObject
iphlpapi.DLL	GetNetworkParams
ole32.DLL	CoCreateInstance, CLSIDFromString, CoInitialize, CoUninitialize
OLEAUT32.DLL	SysAllocString
USER32.DLL	GetWindowTextA, GetForegroundWindow, LoadCursorA, LoadIconA, SetTimer, KillTimer, RegisterClassA, MessageBoxA, GetMessageA, TranslateMessage, DispatchMessageA, PostQuitMessage, CreateWindowExA, DefWindowProcA
wsock32.dll	WSAGetLastError, WSAStartup, closesocket, connect, gethostbyname, htons, inet_addr, ioctlsocket, ntohs, recv, select, send, socket

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 17, 2024 20:02:31.672904015 CEST	49751	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:31.678385019 CEST	53	49751	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:31.678498030 CEST	49751	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:31.678555965 CEST	49751	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:31.683505058 CEST	53	49751	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:32.189266920 CEST	49754	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:32.194802046 CEST	49755	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:32.195992947 CEST	53	49754	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:32.196057081 CEST	49754	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:32.198785067 CEST	49754	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:32.202193022 CEST	53	49755	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:32.202255964 CEST	49755	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:32.202327967 CEST	49755	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:32.202765942 CEST	49756	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:32.205646992 CEST	49757	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:32.206136942 CEST	53	49754	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:32.210215092 CEST	49758	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:32.211002111 CEST	53	49755	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:32.211028099 CEST	53	49756	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:32.211082935 CEST	49756	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:32.211127996 CEST	49756	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:32.212801933 CEST	53	49757	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:32.212871075 CEST	49757	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:32.212913990 CEST	49757	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:32.214715958 CEST	49759	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:32.217398882 CEST	53	49758	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:32.217470884 CEST	49758	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:32.217534065 CEST	49758	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:32.218326092 CEST	53	49756	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:32.220014095 CEST	53	49757	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:32.221132040 CEST	53	49759	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:32.221185923 CEST	49759	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:32.221231937 CEST	49759	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:32.225255966 CEST	53	49758	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:32.228725910 CEST	53	49759	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:32.813043118 CEST	53	49754	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:32.813163996 CEST	49754	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:32.818818092 CEST	53	49754	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:32.818886042 CEST	49754	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:32.830504894 CEST	49764	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:32.833194017 CEST	53	49756	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:32.833288908 CEST	49756	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:32.833895922 CEST	49765	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:32.838660955 CEST	53	49756	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:32.838710070 CEST	49756	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:32.840112925 CEST	53	49757	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:32.840207100 CEST	49757	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:32.840653896 CEST	49766	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:32.845732927 CEST	53	49757	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:32.845787048 CEST	49757	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:32.863497019 CEST	53	49755	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:32.863576889 CEST	49755	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:32.865941048 CEST	53	49758	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:32.866015911 CEST	49758	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:32.868777990 CEST	53	49755	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:32.868839025 CEST	49755	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:32.871824026 CEST	53	49758	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:32.871881962 CEST	49758	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:32.873460054 CEST	49768	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:32.908169985 CEST	53	49759	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:32.908263922 CEST	49759	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:32.908767939 CEST	49769	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:32.913718939 CEST	53	49759	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:32.913781881 CEST	49759	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:33.298768997 CEST	53	49751	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:33.298887014 CEST	49751	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:33.299465895 CEST	49770	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:33.304975033 CEST	53	49751	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:33.305049896 CEST	49751	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:33.829210997 CEST	49764	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:33.844839096 CEST	49766	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:33.848112106 CEST	49765	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:33.878406048 CEST	49768	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:33.916749001 CEST	49769	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:34.275413990 CEST	49776	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:34.280533075 CEST	53	49776	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:34.280642986 CEST	49776	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:34.280704021 CEST	49776	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:34.285516977 CEST	53	49776	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:34.297971964 CEST	49770	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:35.099380016 CEST	53	49776	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:35.099555969 CEST	49776	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:35.106256008 CEST	53	49776	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:35.106429100 CEST	49776	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:35.844826937 CEST	49764	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:35.844827890 CEST	49766	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:35.860443115 CEST	49765	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:35.891689062 CEST	49768	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:35.923010111 CEST	49769	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:36.297982931 CEST	49770	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:36.603528976 CEST	49787	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:36.610357046 CEST	53	49787	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:36.610474110 CEST	49787	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:36.612914085 CEST	49787	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:36.617793083 CEST	53	49787	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:37.249533892 CEST	53	49787	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:37.249630928 CEST	49787	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:37.254909992 CEST	53	49787	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:37.257550001 CEST	49787	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:38.649769068 CEST	49798	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:38.654752970 CEST	53	49798	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:38.654853106 CEST	49798	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:38.654906034 CEST	49798	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:38.659706116 CEST	53	49798	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:39.280539989 CEST	53	49798	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:39.280633926 CEST	49798	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:39.285892010 CEST	53	49798	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:39.285959005 CEST	49798	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:39.849586010 CEST	49766	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:39.860476971 CEST	49764	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:39.860488892 CEST	49765	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:39.891720057 CEST	49768	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:39.922982931 CEST	49769	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:40.360467911 CEST	49770	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:40.804605961 CEST	49814	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:40.810194969 CEST	53	49814	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:40.810307980 CEST	49814	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:40.810364962 CEST	49814	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:40.815253973 CEST	53	49814	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:41.472033024 CEST	53	49814	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:41.472126961 CEST	49814	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:41.477535009 CEST	53	49814	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:41.477634907 CEST	49814	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:41.971856117 CEST	49823	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:41.977133036 CEST	53	49823	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:41.977257013 CEST	49823	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:41.979149103 CEST	49824	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:41.979149103 CEST	49823	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:41.984071970 CEST	53	49824	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:41.984148979 CEST	53	49823	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:41.984265089 CEST	49824	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:41.984265089 CEST	49824	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:41.985101938 CEST	49825	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:41.989198923 CEST	53	49824	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:41.989949942 CEST	53	49825	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:41.993433952 CEST	49826	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:41.993433952 CEST	49825	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:41.993550062 CEST	49825	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:41.995526075 CEST	49827	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:41.998871088 CEST	53	49826	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:41.998958111 CEST	53	49825	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:41.999118090 CEST	49826	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:41.999118090 CEST	49826	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:42.000415087 CEST	53	49827	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:42.000859022 CEST	49827	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:42.001213074 CEST	49827	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:42.004374981 CEST	53	49826	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:42.004867077 CEST	49828	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:42.006370068 CEST	53	49827	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:42.009835958 CEST	53	49828	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:42.010231972 CEST	49828	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:42.010576010 CEST	49828	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:42.010864019 CEST	49829	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:42.015353918 CEST	53	49828	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:42.015922070 CEST	53	49829	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:42.016051054 CEST	49829	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:42.017591953 CEST	49829	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:42.022540092 CEST	53	49829	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:42.589468956 CEST	53	49823	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:42.589946985 CEST	49823	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:42.592961073 CEST	49835	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:42.595397949 CEST	53	49823	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:42.595560074 CEST	49823	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:42.615298033 CEST	53	49824	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:42.619488955 CEST	49836	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:42.619491100 CEST	49824	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:42.621620893 CEST	53	49829	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:42.624825954 CEST	53	49824	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:42.626662016 CEST	53	49825	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:42.627149105 CEST	49824	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:42.627526999 CEST	49829	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:42.632771969 CEST	53	49829	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:42.635127068 CEST	49829	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:42.640028954 CEST	53	49828	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:42.641351938 CEST	49825	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:42.641498089 CEST	49828	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:42.642066002 CEST	49837	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:42.642477989 CEST	49838	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:42.646680117 CEST	53	49825	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:42.646790028 CEST	49825	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:42.647351027 CEST	53	49828	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:42.647420883 CEST	49828	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:42.655005932 CEST	53	49827	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:42.655127048 CEST	49827	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:42.655682087 CEST	49839	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:42.660547018 CEST	53	49827	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:42.660653114 CEST	49827	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:42.669969082 CEST	53	49826	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:42.670068979 CEST	49826	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:42.670509100 CEST	49840	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:42.676717997 CEST	53	49826	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:42.677268028 CEST	49826	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:42.873148918 CEST	49841	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:42.878459930 CEST	53	49841	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:42.878612041 CEST	49841	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:42.878637075 CEST	49841	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:42.884437084 CEST	53	49841	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:43.497214079 CEST	53	49841	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:43.497364998 CEST	49841	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:43.502952099 CEST	53	49841	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:43.503079891 CEST	49841	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:43.507016897 CEST	49845	25	192.168.2.7	74.125.206.27
Oct 17, 2024 20:02:43.594847918 CEST	49835	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:43.626113892 CEST	49836	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:43.657376051 CEST	49838	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:43.657565117 CEST	49839	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:43.673090935 CEST	49837	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:43.673161030 CEST	49840	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:44.113989115 CEST	49848	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:44.119494915 CEST	53	49848	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:44.119570017 CEST	49848	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:44.119651079 CEST	49848	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:44.124577045 CEST	53	49848	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:44.548036098 CEST	49845	25	192.168.2.7	74.125.206.27
Oct 17, 2024 20:02:44.975835085 CEST	53	49848	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:44.975927114 CEST	49848	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:44.981435061 CEST	53	49848	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:44.981508017 CEST	49848	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:45.353734970 CEST	61529	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:45.360615015 CEST	53	61529	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:45.360790014 CEST	61529	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:45.402162075 CEST	53	61529	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:45.657396078 CEST	49838	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:45.657449007 CEST	49839	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:45.704271078 CEST	49835	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:45.704288960 CEST	49836	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:45.704292059 CEST	49837	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:45.704384089 CEST	49840	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:45.985656977 CEST	61529	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:45.990966082 CEST	53	61529	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:45.991276979 CEST	61529	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:46.120057106 CEST	61534	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:46.125037909 CEST	53	61534	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:46.126590967 CEST	61534	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:46.127094030 CEST	61534	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:46.132122040 CEST	53	61534	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:46.548120975 CEST	49845	25	192.168.2.7	74.125.206.27
Oct 17, 2024 20:02:46.758001089 CEST	53	61534	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:46.758130074 CEST	61534	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:46.763617992 CEST	53	61534	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:46.763809919 CEST	61534	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:47.860517979 CEST	49766	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:47.891763926 CEST	49764	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:47.891781092 CEST	49768	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:47.891782045 CEST	49765	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:48.001157045 CEST	49769	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:48.198470116 CEST	61548	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:48.256860018 CEST	53	61548	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:48.256937027 CEST	61548	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:48.257060051 CEST	61548	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:48.360527039 CEST	49770	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:48.518199921 CEST	53	61548	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:49.176964045 CEST	53	61548	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:49.177823067 CEST	61548	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:49.183128119 CEST	53	61548	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:49.183435917 CEST	61548	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:49.657404900 CEST	49838	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:49.657406092 CEST	49839	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:49.719892025 CEST	49836	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:49.719891071 CEST	49835	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:49.719961882 CEST	49837	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:49.719964981 CEST	49840	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:50.381794930 CEST	61558	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:50.387375116 CEST	53	61558	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:50.387471914 CEST	61558	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:50.387541056 CEST	61558	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:50.392421961 CEST	53	61558	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:50.548027992 CEST	49845	25	192.168.2.7	74.125.206.27
Oct 17, 2024 20:02:50.993916035 CEST	53	61558	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:50.995527029 CEST	61558	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:51.000899076 CEST	53	61558	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:51.003536940 CEST	61558	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:52.433459997 CEST	61570	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:52.438452959 CEST	53	61570	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:52.438544035 CEST	61570	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:52.438755035 CEST	61570	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:52.443588972 CEST	53	61570	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:53.396567106 CEST	53	61570	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:53.396697998 CEST	61570	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:53.397389889 CEST	61577	25	192.168.2.7	74.125.206.27
Oct 17, 2024 20:02:53.401896954 CEST	53	61570	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:53.402000904 CEST	61570	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:54.407454014 CEST	61577	25	192.168.2.7	74.125.206.27
Oct 17, 2024 20:02:56.407532930 CEST	61577	25	192.168.2.7	74.125.206.27
Oct 17, 2024 20:02:57.657479048 CEST	49839	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:57.657483101 CEST	49838	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:57.719940901 CEST	49835	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:57.719958067 CEST	49836	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:57.719991922 CEST	49837	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:57.719999075 CEST	49840	25	192.168.2.7	142.251.9.27
Oct 17, 2024 20:02:58.548052073 CEST	49845	25	192.168.2.7	74.125.206.27
Oct 17, 2024 20:03:00.423070908 CEST	61577	25	192.168.2.7	74.125.206.27
Oct 17, 2024 20:03:04.850600958 CEST	61641	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:04.855926991 CEST	53	61641	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:04.856018066 CEST	61641	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:04.856077909 CEST	61641	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:04.861879110 CEST	53	61641	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:04.864830971 CEST	61643	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:04.870476007 CEST	61644	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:04.870704889 CEST	53	61643	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:04.870809078 CEST	61643	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:04.870923042 CEST	61643	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:04.874335051 CEST	61642	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:04.876288891 CEST	53	61644	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:04.876370907 CEST	61644	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:04.877006054 CEST	53	61643	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:04.880273104 CEST	53	61642	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:04.880350113 CEST	61642	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:04.880752087 CEST	61644	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:04.881062031 CEST	61642	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:04.886512995 CEST	53	61644	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:04.886806011 CEST	53	61642	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:04.887209892 CEST	61645	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:04.887867928 CEST	61646	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:04.892122030 CEST	53	61645	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:04.892191887 CEST	61645	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:04.893004894 CEST	53	61646	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:04.893060923 CEST	61646	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:04.893460035 CEST	61645	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:04.893544912 CEST	61646	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:04.898284912 CEST	53	61645	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:04.898447990 CEST	53	61646	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:05.472579002 CEST	53	61641	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:05.472757101 CEST	61641	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:05.478115082 CEST	53	61641	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:05.478193998 CEST	61641	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:05.484711885 CEST	61652	25	192.168.2.7	52.101.42.5
Oct 17, 2024 20:03:05.507949114 CEST	53	61645	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:05.514014006 CEST	61645	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:05.519438028 CEST	53	61645	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:05.519495010 CEST	61645	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:05.522303104 CEST	61653	25	192.168.2.7	74.125.200.26
Oct 17, 2024 20:03:05.562788963 CEST	53	61643	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:05.562977076 CEST	61643	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:05.569222927 CEST	53	61643	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:05.569300890 CEST	61643	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:05.647842884 CEST	53	61644	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:05.647994995 CEST	61644	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:05.653723955 CEST	53	61644	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:05.653812885 CEST	61644	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:05.759618044 CEST	53	61646	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:05.759741068 CEST	61646	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:05.765896082 CEST	53	61646	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:05.765968084 CEST	61646	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:06.485591888 CEST	61652	25	192.168.2.7	52.101.42.5
Oct 17, 2024 20:03:06.532450914 CEST	61653	25	192.168.2.7	74.125.200.26
Oct 17, 2024 20:03:06.913836956 CEST	61661	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:06.918776035 CEST	53	61661	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:06.918883085 CEST	61662	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:06.918916941 CEST	61661	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:06.919024944 CEST	61661	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:06.923823118 CEST	53	61662	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:06.923952103 CEST	61663	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:06.923996925 CEST	61662	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:06.924074888 CEST	61662	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:06.924632072 CEST	53	61661	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:06.928997040 CEST	53	61663	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:06.929018021 CEST	53	61662	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:06.929205894 CEST	61663	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:06.929239988 CEST	61663	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:06.934211016 CEST	53	61663	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:06.945296049 CEST	53	61642	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:06.945390940 CEST	61642	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:06.952630997 CEST	53	61642	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:06.952698946 CEST	61642	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:07.577963114 CEST	53	61661	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:07.585694075 CEST	61661	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:07.591315031 CEST	53	61661	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:07.593476057 CEST	61661	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:07.660904884 CEST	53	61662	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:07.680154085 CEST	61662	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:07.685529947 CEST	53	61662	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:07.685601950 CEST	61662	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:07.728584051 CEST	61667	25	192.168.2.7	193.42.222.38
Oct 17, 2024 20:03:08.101253033 CEST	53	61663	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:08.101604939 CEST	61663	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:08.116305113 CEST	53	61663	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:08.116389990 CEST	61663	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:08.140790939 CEST	61671	25	192.168.2.7	52.101.73.28
Oct 17, 2024 20:03:08.423105001 CEST	61577	25	192.168.2.7	74.125.206.27
Oct 17, 2024 20:03:08.491894007 CEST	61652	25	192.168.2.7	52.101.42.5
Oct 17, 2024 20:03:08.548082113 CEST	61653	25	192.168.2.7	74.125.200.26
Oct 17, 2024 20:03:08.735588074 CEST	61667	25	192.168.2.7	193.42.222.38
Oct 17, 2024 20:03:08.802700996 CEST	61676	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:08.807849884 CEST	53	61676	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:08.807936907 CEST	61676	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:08.807995081 CEST	61676	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:08.813153028 CEST	53	61676	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:08.817823887 CEST	61677	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:08.823290110 CEST	53	61677	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:08.823367119 CEST	61677	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:08.823420048 CEST	61677	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:08.828285933 CEST	53	61677	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:09.141836882 CEST	61671	25	192.168.2.7	52.101.73.28
Oct 17, 2024 20:03:09.462554932 CEST	53	61677	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:09.462692976 CEST	61677	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:09.467952013 CEST	53	61677	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:09.468066931 CEST	61677	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:09.497747898 CEST	53	61676	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:09.497848988 CEST	61676	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:09.503206968 CEST	53	61676	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:09.503259897 CEST	61676	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:10.735605001 CEST	61667	25	192.168.2.7	193.42.222.38
Oct 17, 2024 20:03:10.865211010 CEST	61683	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:10.868705034 CEST	61684	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:10.870129108 CEST	53	61683	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:10.871613026 CEST	61683	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:10.871707916 CEST	61683	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:10.873557091 CEST	53	61684	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:10.873624086 CEST	61684	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:10.873667955 CEST	61684	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:10.876530886 CEST	53	61683	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:10.878577948 CEST	53	61684	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:11.141851902 CEST	61671	25	192.168.2.7	52.101.73.28
Oct 17, 2024 20:03:11.503228903 CEST	53	61684	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:11.503312111 CEST	61684	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:11.503916025 CEST	61688	25	192.168.2.7	74.125.206.27
Oct 17, 2024 20:03:11.509983063 CEST	53	61683	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:11.510067940 CEST	61683	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:11.511538029 CEST	53	61684	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:11.511589050 CEST	61684	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:11.515528917 CEST	53	61683	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:11.515588045 CEST	61683	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:12.501238108 CEST	61652	25	192.168.2.7	52.101.42.5
Oct 17, 2024 20:03:12.516921997 CEST	61688	25	192.168.2.7	74.125.206.27
Oct 17, 2024 20:03:12.548156023 CEST	61653	25	192.168.2.7	74.125.200.26
Oct 17, 2024 20:03:12.945713043 CEST	61695	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:12.951035023 CEST	53	61695	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:12.951160908 CEST	61695	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:12.951230049 CEST	61695	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:12.956340075 CEST	53	61695	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:13.745976925 CEST	53	61695	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:13.746268988 CEST	61695	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:13.751768112 CEST	53	61695	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:13.751878023 CEST	61695	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:13.761750937 CEST	61700	25	192.168.2.7	192.124.249.110
Oct 17, 2024 20:03:14.532535076 CEST	61688	25	192.168.2.7	74.125.206.27
Oct 17, 2024 20:03:14.751296997 CEST	61667	25	192.168.2.7	193.42.222.38
Oct 17, 2024 20:03:14.766896009 CEST	61700	25	192.168.2.7	192.124.249.110
Oct 17, 2024 20:03:15.141916037 CEST	61671	25	192.168.2.7	52.101.73.28
Oct 17, 2024 20:03:15.477705002 CEST	61711	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:15.482808113 CEST	53	61711	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:15.482923031 CEST	61711	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:15.483074903 CEST	61711	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:15.488282919 CEST	53	61711	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:16.095861912 CEST	53	61711	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:16.096019030 CEST	61711	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:16.101531029 CEST	53	61711	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:16.101619005 CEST	61711	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:16.782572031 CEST	61700	25	192.168.2.7	192.124.249.110
Oct 17, 2024 20:03:17.350055933 CEST	61720	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:17.355237961 CEST	53	61720	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:17.355434895 CEST	61720	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:17.355434895 CEST	61720	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:17.360438108 CEST	53	61720	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:18.029957056 CEST	53	61720	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:18.030164003 CEST	61720	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:18.036448956 CEST	53	61720	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:18.036525011 CEST	61720	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:18.532502890 CEST	61688	25	192.168.2.7	74.125.206.27
Oct 17, 2024 20:03:19.131222963 CEST	61725	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:19.136703014 CEST	53	61725	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:19.136778116 CEST	61725	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:19.136831999 CEST	61725	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:19.141978979 CEST	53	61725	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:19.758054018 CEST	53	61725	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:19.758168936 CEST	61725	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:19.764573097 CEST	53	61725	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:19.764848948 CEST	61725	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:20.501293898 CEST	61652	25	192.168.2.7	52.101.42.5
Oct 17, 2024 20:03:20.548230886 CEST	61653	25	192.168.2.7	74.125.200.26
Oct 17, 2024 20:03:20.787240028 CEST	61726	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:20.792396069 CEST	53	61726	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:20.792495012 CEST	61726	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:20.792685986 CEST	61726	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:20.797589064 CEST	53	61726	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:20.798135042 CEST	61700	25	192.168.2.7	192.124.249.110
Oct 17, 2024 20:03:21.452949047 CEST	53	61726	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:21.453043938 CEST	61726	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:21.458422899 CEST	53	61726	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:21.458476067 CEST	61726	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:21.461214066 CEST	61727	25	192.168.2.7	212.227.15.41
Oct 17, 2024 20:03:22.470068932 CEST	61727	25	192.168.2.7	212.227.15.41
Oct 17, 2024 20:03:22.751548052 CEST	61667	25	192.168.2.7	193.42.222.38
Oct 17, 2024 20:03:23.157785892 CEST	61671	25	192.168.2.7	52.101.73.28
Oct 17, 2024 20:03:24.470045090 CEST	61727	25	192.168.2.7	212.227.15.41
Oct 17, 2024 20:03:26.548175097 CEST	61688	25	192.168.2.7	74.125.206.27
Oct 17, 2024 20:03:27.709810019 CEST	61729	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:27.713758945 CEST	61730	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:27.714854956 CEST	53	61729	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:27.714943886 CEST	61729	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:27.714981079 CEST	61729	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:27.718646049 CEST	53	61730	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:27.718729019 CEST	61730	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:27.718931913 CEST	61730	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:27.720014095 CEST	53	61729	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:27.724256039 CEST	53	61730	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:28.485683918 CEST	61727	25	192.168.2.7	212.227.15.41
Oct 17, 2024 20:03:28.495239973 CEST	53	61729	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:28.495336056 CEST	61729	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:28.495953083 CEST	61731	25	192.168.2.7	212.227.15.41
Oct 17, 2024 20:03:28.500870943 CEST	53	61729	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:28.500941992 CEST	61729	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:28.519844055 CEST	53	61730	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:28.519931078 CEST	61730	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:28.525191069 CEST	53	61730	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:28.525250912 CEST	61730	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:28.544116020 CEST	61732	25	192.168.2.7	116.202.20.146
Oct 17, 2024 20:03:28.813827991 CEST	61700	25	192.168.2.7	192.124.249.110
Oct 17, 2024 20:03:29.501364946 CEST	61731	25	192.168.2.7	212.227.15.41
Oct 17, 2024 20:03:29.548182964 CEST	61732	25	192.168.2.7	116.202.20.146
Oct 17, 2024 20:03:29.865828037 CEST	61733	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:29.870712042 CEST	53	61733	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:29.870830059 CEST	61733	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:29.870894909 CEST	61733	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:29.875797033 CEST	53	61733	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:30.367172956 CEST	61734	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:30.372148037 CEST	53	61734	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:30.372246027 CEST	61734	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:30.372342110 CEST	61734	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:30.377315044 CEST	53	61734	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:30.554155111 CEST	53	61733	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:30.554312944 CEST	61733	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:30.555130959 CEST	61735	25	192.168.2.7	212.227.15.41
Oct 17, 2024 20:03:30.559444904 CEST	53	61733	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:30.559525013 CEST	61733	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:31.501310110 CEST	61731	25	192.168.2.7	212.227.15.41
Oct 17, 2024 20:03:31.548176050 CEST	61732	25	192.168.2.7	116.202.20.146
Oct 17, 2024 20:03:31.563858032 CEST	61735	25	192.168.2.7	212.227.15.41
Oct 17, 2024 20:03:31.629719973 CEST	53	61734	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:31.629884958 CEST	61734	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:31.635277033 CEST	53	61734	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:31.635345936 CEST	61734	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:31.701019049 CEST	61736	25	192.168.2.7	217.13.200.22
Oct 17, 2024 20:03:32.704471111 CEST	61736	25	192.168.2.7	217.13.200.22
Oct 17, 2024 20:03:33.567827940 CEST	61735	25	192.168.2.7	212.227.15.41
Oct 17, 2024 20:03:33.615490913 CEST	61737	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:33.620511055 CEST	53	61737	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:33.620604992 CEST	61737	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:33.620835066 CEST	61737	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:33.625715971 CEST	53	61737	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:34.618278027 CEST	53	61737	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:34.618421078 CEST	61737	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:34.623672962 CEST	53	61737	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:34.623754978 CEST	61737	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:34.637440920 CEST	61738	25	192.168.2.7	85.13.166.174
Oct 17, 2024 20:03:34.720156908 CEST	61736	25	192.168.2.7	217.13.200.22
Oct 17, 2024 20:03:35.501389980 CEST	61731	25	192.168.2.7	212.227.15.41
Oct 17, 2024 20:03:35.548232079 CEST	61732	25	192.168.2.7	116.202.20.146
Oct 17, 2024 20:03:35.626365900 CEST	61738	25	192.168.2.7	85.13.166.174
Oct 17, 2024 20:03:35.870359898 CEST	61739	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:36.035124063 CEST	53	61739	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:36.035242081 CEST	61739	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:36.035370111 CEST	61739	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:36.040209055 CEST	53	61739	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:36.501444101 CEST	61727	25	192.168.2.7	212.227.15.41
Oct 17, 2024 20:03:37.333700895 CEST	53	61739	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:37.333873034 CEST	61739	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:37.339523077 CEST	53	61739	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:37.339592934 CEST	61739	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:37.360635042 CEST	61740	25	192.168.2.7	91.198.189.25
Oct 17, 2024 20:03:37.563858032 CEST	61735	25	192.168.2.7	212.227.15.41
Oct 17, 2024 20:03:37.626343966 CEST	61738	25	192.168.2.7	85.13.166.174
Oct 17, 2024 20:03:38.345098972 CEST	61740	25	192.168.2.7	91.198.189.25
Oct 17, 2024 20:03:38.735724926 CEST	61736	25	192.168.2.7	217.13.200.22
Oct 17, 2024 20:03:40.345097065 CEST	61740	25	192.168.2.7	91.198.189.25
Oct 17, 2024 20:03:41.626369953 CEST	61738	25	192.168.2.7	85.13.166.174
Oct 17, 2024 20:03:42.773228884 CEST	61741	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:42.778331995 CEST	53	61741	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:42.778532982 CEST	61741	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:42.778708935 CEST	61741	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:42.783632994 CEST	53	61741	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:43.241398096 CEST	61742	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:43.246270895 CEST	53	61742	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:43.246364117 CEST	61742	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:43.246457100 CEST	61742	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:43.247231007 CEST	61743	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:43.251784086 CEST	53	61742	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:43.252418995 CEST	53	61743	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:43.252496004 CEST	61743	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:43.252697945 CEST	61743	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:43.257770061 CEST	53	61743	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:43.400312901 CEST	53	61741	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:43.400490999 CEST	61741	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:43.406549931 CEST	53	61741	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:43.406636000 CEST	61741	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:43.553175926 CEST	61744	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:43.558088064 CEST	53	61744	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:43.558207035 CEST	61744	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:43.558378935 CEST	61744	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:43.563496113 CEST	53	61744	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:43.664585114 CEST	61745	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:43.670428991 CEST	53	61745	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:43.670522928 CEST	61745	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:43.670593023 CEST	61745	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:43.675558090 CEST	53	61745	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:43.929126978 CEST	61746	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:44.147587061 CEST	61747	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:44.149200916 CEST	53	61742	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:44.150567055 CEST	53	61743	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:44.151060104 CEST	53	61742	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:44.151108027 CEST	61742	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:44.152512074 CEST	53	61746	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:44.152571917 CEST	61746	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:44.152658939 CEST	61746	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:44.153301954 CEST	53	61747	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:44.153366089 CEST	61747	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:44.153481007 CEST	61747	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:44.157567024 CEST	53	61746	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:44.158477068 CEST	53	61747	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:44.187609911 CEST	53	61744	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:44.190620899 CEST	53	61743	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:44.190697908 CEST	61743	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:44.235728025 CEST	61744	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:44.427783012 CEST	61748	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:44.432693005 CEST	53	61748	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:44.432811975 CEST	61748	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:44.432869911 CEST	61748	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:44.437700033 CEST	53	61748	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:44.440144062 CEST	53	61745	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:44.485754013 CEST	61745	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:44.908622980 CEST	53	61747	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:44.954595089 CEST	61747	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:45.075118065 CEST	53	61746	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:45.126334906 CEST	61746	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:45.234471083 CEST	53	61748	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:45.282618046 CEST	61748	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:47.035721064 CEST	61749	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:47.037619114 CEST	61750	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:47.040647984 CEST	53	61749	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:47.040754080 CEST	61749	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:47.040849924 CEST	61749	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:47.042756081 CEST	53	61750	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:47.043715000 CEST	61750	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:47.043785095 CEST	61750	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:47.045835972 CEST	53	61749	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:47.048826933 CEST	53	61750	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:47.634429932 CEST	53	61749	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:47.634582996 CEST	61749	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:47.641772985 CEST	53	61749	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:47.641844988 CEST	61749	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:47.644046068 CEST	53	61750	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:47.644143105 CEST	61750	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:47.650513887 CEST	53	61750	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:47.652848005 CEST	61750	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:53.887221098 CEST	53	61742	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:53.887286901 CEST	61742	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:53.890940905 CEST	53	61743	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:53.893668890 CEST	61743	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:54.189377069 CEST	53	61744	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:54.189435005 CEST	61744	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:54.278399944 CEST	53	61745	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:54.281547070 CEST	61745	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:54.787545919 CEST	53	61746	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:54.789287090 CEST	53	61747	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:54.789359093 CEST	61746	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:54.789518118 CEST	61747	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:55.050169945 CEST	53	61748	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:55.050221920 CEST	61748	53	192.168.2.7	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 17, 2024 20:02:19.227881908 CEST	61445	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:30.328043938 CEST	62618	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:30.335427046 CEST	53	62618	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:32.818161964 CEST	62992	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:32.829463005 CEST	53	62992	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:43.497930050 CEST	59038	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:02:43.506225109 CEST	53	59038	1.1.1.1	192.168.2.7
Oct 17, 2024 20:02:45.352641106 CEST	53	64676	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:05.473228931 CEST	50327	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:05.484056950 CEST	53	50327	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:05.514619112 CEST	57170	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:05.521600962 CEST	53	57170	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:06.945962906 CEST	55897	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:06.953793049 CEST	53	55897	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:07.680766106 CEST	64070	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:07.725754023 CEST	53	64070	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:08.102183104 CEST	57843	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:08.140208960 CEST	53	57843	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:13.746958971 CEST	64833	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:13.760760069 CEST	53	64833	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:21.453537941 CEST	50724	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:21.460581064 CEST	53	50724	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:28.520360947 CEST	62339	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:28.543644905 CEST	53	62339	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:31.630444050 CEST	56937	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:31.700397015 CEST	53	56937	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:34.619025946 CEST	55625	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:34.636754036 CEST	53	55625	1.1.1.1	192.168.2.7
Oct 17, 2024 20:03:37.334536076 CEST	53910	53	192.168.2.7	1.1.1.1
Oct 17, 2024 20:03:37.359704018 CEST	53	53910	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 17, 2024 20:02:19.227881908 CEST	192.168.2.7	1.1.1.1	0x38b8	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:02:30.328043938 CEST	192.168.2.7	1.1.1.1	0xeb5e	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:02:31.678555965 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	mozilla.org	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:32.198785067 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	mozilla.org	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:32.202327967 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	search.mozilla.org	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:32.211127996 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	mozilla.com	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:32.212913990 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	mozilla.org	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:32.217534065 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	mozilla.org	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:32.221231937 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	mozilla.org	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:32.818161964 CEST	192.168.2.7	1.1.1.1	0x5010	Standard query (0)	aspmx3.googlemail.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:02:34.280704021 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	search.mozilla.org	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:36.612914085 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	search.mozilla.org	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:38.654906034 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	search.mozilla.org	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:40.810364962 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	search.mozilla.org	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:41.979149103 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	mozilla.org	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:41.984265089 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	mozilla.org	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:41.993550062 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	search.mozilla.org	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:41.999118090 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	mozilla.org	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:42.001213074 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	mozilla.org	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:42.010576010 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	mozilla.com	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:42.017591953 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	mozilla.org	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:42.878637075 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	google.com	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:43.497930050 CEST	192.168.2.7	1.1.1.1	0x8483	Standard query (0)	smtp.google.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:02:44.119651079 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	search.mozilla.org	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:46.127094030 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	search.mozilla.org	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:48.257060051 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	search.mozilla.org	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:50.387541056 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	search.mozilla.org	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:52.438755035 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	google.com	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:04.856077909 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	outlook.com	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:04.870923042 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	2x.png	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:04.880752087 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	accv.es	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:04.881062031 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	trustcentre.co.za	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:04.893460035 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	gmail.com	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:04.893544912 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	mtin.es	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:05.473228931 CEST	192.168.2.7	1.1.1.1	0x959b	Standard query (0)	outlook-com.olc.protection.outlook.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:03:05.514619112 CEST	192.168.2.7	1.1.1.1	0x158d	Standard query (0)	alt4.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:03:06.919024944 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	catcert.net	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:06.924074888 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	e-szigno.hu	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:06.929239988 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	sk.ee	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:06.945962906 CEST	192.168.2.7	1.1.1.1	0xe5bc	Standard query (0)	in.hes.trendmicro.eu	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:03:07.680766106 CEST	192.168.2.7	1.1.1.1	0x10a9	Standard query (0)	mail.microsec.hu	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:03:08.102183104 CEST	192.168.2.7	1.1.1.1	0x7852	Standard query (0)	sk-ee.mail.protection.outlook.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:03:08.807995081 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	chambersign.org	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:08.823420048 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	chambersign.org	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:10.871707916 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	garagejournal.com	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:10.873667955 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	tripadvisor.com	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:12.951230049 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	mylivewallpapers.com	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:13.746958971 CEST	192.168.2.7	1.1.1.1	0x77ce	Standard query (0)	mylivewallpapers.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:03:15.483074903 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	candidate.hr-manager.net	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:19.136831999 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	ads.talkscreativity.com	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:20.792685986 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	belgieninfo.net	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:21.453537941 CEST	192.168.2.7	1.1.1.1	0x6e6e	Standard query (0)	mx00.ionos.de	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:03:27.714981079 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	delamar.de	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:27.718931913 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	googlewatchblog.de	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:28.520360947 CEST	192.168.2.7	1.1.1.1	0x6089	Standard query (0)	pommes.hebbet.de	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:03:29.870894909 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	lintorfer.eu	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:30.372342110 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	schule-studium.de	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:31.630444050 CEST	192.168.2.7	1.1.1.1	0xd196	Standard query (0)	mx2.schule-studium.de	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:03:33.620835066 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	windowspower.de	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:34.619025946 CEST	192.168.2.7	1.1.1.1	0xf99a	Standard query (0)	w0187a3c.kasserver.com	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:03:36.035370111 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	wirsiegen.de	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:37.334536076 CEST	192.168.2.7	1.1.1.1	0x7813	Standard query (0)	mx04.mail.millenniumarts.net	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:03:42.778708935 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	wp.com	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:43.246457100 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	guenstiger.de	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:43.252697945 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	games.ch	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:43.558378935 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	zentrum-der-gesundheit.de	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:43.670593023 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	stroeerdigitalgroup.de	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:44.152658939 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	radiosantiago.cl	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:44.153481007 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	fanpelis.ac	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:44.432869911 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	blog.lesoir.be	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:47.040849924 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	mozilla.org.xpi	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:47.043785095 CEST	192.168.2.7	1.1.1.1	0x7a69	Standard query (0)	mozilla.org.xpi	MX (Mail exchange)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 17, 2024 20:02:19.235368967 CEST	1.1.1.1	192.168.2.7	0x38b8	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 20:02:22.310487032 CEST	1.1.1.1	192.168.2.7	0x49b9	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 20:02:22.310487032 CEST	1.1.1.1	192.168.2.7	0x49b9	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:02:30.335427046 CEST	1.1.1.1	192.168.2.7	0xeb5e	No error (0)	www.google.com		142.250.184.196	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:02:32.813043118 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:32.813043118 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:32.813043118 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:32.813043118 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:32.829463005 CEST	1.1.1.1	192.168.2.7	0x5010	No error (0)	aspmx3.googlemail.com		142.251.9.27	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:02:32.833194017 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.com			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:32.833194017 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.com			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:32.833194017 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.com			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:32.833194017 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.com			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:32.840112925 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:32.840112925 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:32.840112925 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:32.840112925 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:32.863497019 CEST	1.1.1.1	192.168.2.7	0x7a69	Name error (3)	search.mozilla.org	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:32.865941048 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:32.865941048 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:32.865941048 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:32.865941048 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:32.908169985 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:32.908169985 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:32.908169985 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:32.908169985 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:33.298768997 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:33.298768997 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:33.298768997 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:33.298768997 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:35.099380016 CEST	1.1.1.1	192.168.2.7	0x7a69	Name error (3)	search.mozilla.org	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:37.249533892 CEST	1.1.1.1	192.168.2.7	0x7a69	Name error (3)	search.mozilla.org	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:39.280539989 CEST	1.1.1.1	192.168.2.7	0x7a69	Name error (3)	search.mozilla.org	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:41.472033024 CEST	1.1.1.1	192.168.2.7	0x7a69	Name error (3)	search.mozilla.org	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:42.589468956 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:42.589468956 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:42.589468956 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:42.589468956 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:42.615298033 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:42.615298033 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:42.615298033 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:42.615298033 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:42.621620893 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:42.621620893 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:42.621620893 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:42.621620893 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:42.626662016 CEST	1.1.1.1	192.168.2.7	0x7a69	Name error (3)	search.mozilla.org	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:42.640028954 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.com			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:42.640028954 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.com			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:42.640028954 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.com			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:42.640028954 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.com			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:42.655005932 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:42.655005932 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:42.655005932 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:42.655005932 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:42.669969082 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:42.669969082 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:42.669969082 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:42.669969082 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mozilla.org			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:43.497214079 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	google.com			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:43.506225109 CEST	1.1.1.1	192.168.2.7	0x8483	No error (0)	smtp.google.com		74.125.206.27	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:02:43.506225109 CEST	1.1.1.1	192.168.2.7	0x8483	No error (0)	smtp.google.com		64.233.167.27	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:02:43.506225109 CEST	1.1.1.1	192.168.2.7	0x8483	No error (0)	smtp.google.com		74.125.206.26	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:02:43.506225109 CEST	1.1.1.1	192.168.2.7	0x8483	No error (0)	smtp.google.com		64.233.166.26	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:02:43.506225109 CEST	1.1.1.1	192.168.2.7	0x8483	No error (0)	smtp.google.com		64.233.167.26	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:02:44.975835085 CEST	1.1.1.1	192.168.2.7	0x7a69	Name error (3)	search.mozilla.org	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:46.758001089 CEST	1.1.1.1	192.168.2.7	0x7a69	Name error (3)	search.mozilla.org	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:49.176964045 CEST	1.1.1.1	192.168.2.7	0x7a69	Name error (3)	search.mozilla.org	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:50.993916035 CEST	1.1.1.1	192.168.2.7	0x7a69	Name error (3)	search.mozilla.org	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:02:53.396567106 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	google.com			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:05.472579002 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	outlook.com			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:05.484056950 CEST	1.1.1.1	192.168.2.7	0x959b	No error (0)	outlook-com.olc.protection.outlook.com		52.101.42.5	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:03:05.484056950 CEST	1.1.1.1	192.168.2.7	0x959b	No error (0)	outlook-com.olc.protection.outlook.com		52.101.73.20	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:03:05.484056950 CEST	1.1.1.1	192.168.2.7	0x959b	No error (0)	outlook-com.olc.protection.outlook.com		52.101.11.18	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:03:05.484056950 CEST	1.1.1.1	192.168.2.7	0x959b	No error (0)	outlook-com.olc.protection.outlook.com		52.101.11.16	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:03:05.507949114 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:05.507949114 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:05.507949114 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:05.507949114 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:05.507949114 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	gmail.com			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:05.521600962 CEST	1.1.1.1	192.168.2.7	0x158d	No error (0)	alt4.gmail-smtp-in.l.google.com		74.125.200.26	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:03:05.562788963 CEST	1.1.1.1	192.168.2.7	0x7a69	Name error (3)	2x.png	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:05.647842884 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	accv.es			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:06.945296049 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	trustcentre.co.za			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:06.945296049 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	trustcentre.co.za			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:06.953793049 CEST	1.1.1.1	192.168.2.7	0xe5bc	Name error (3)	in.hes.trendmicro.eu	none	none	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:03:07.577963114 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	catcert.net			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:07.660904884 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	e-szigno.hu			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:07.725754023 CEST	1.1.1.1	192.168.2.7	0x10a9	No error (0)	mail.microsec.hu		193.42.222.38	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:03:08.101253033 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	sk.ee			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:08.140208960 CEST	1.1.1.1	192.168.2.7	0x7852	No error (0)	sk-ee.mail.protection.outlook.com		52.101.73.28	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:03:08.140208960 CEST	1.1.1.1	192.168.2.7	0x7852	No error (0)	sk-ee.mail.protection.outlook.com		52.101.68.27	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:03:08.140208960 CEST	1.1.1.1	192.168.2.7	0x7852	No error (0)	sk-ee.mail.protection.outlook.com		52.101.68.36	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:03:08.140208960 CEST	1.1.1.1	192.168.2.7	0x7852	No error (0)	sk-ee.mail.protection.outlook.com		52.101.73.16	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:03:11.503228903 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	tripadvisor.com			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:11.509983063 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	garagejournal.com			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:13.745976925 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	mylivewallpapers.com			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:13.760760069 CEST	1.1.1.1	192.168.2.7	0x77ce	No error (0)	mylivewallpapers.com		192.124.249.110	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:03:21.452949047 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	belgieninfo.net			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:21.452949047 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	belgieninfo.net			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:21.460581064 CEST	1.1.1.1	192.168.2.7	0x6e6e	No error (0)	mx00.ionos.de		212.227.15.41	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:03:28.495239973 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	delamar.de			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:28.495239973 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	delamar.de			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:28.519844055 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	googlewatchblog.de			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:28.543644905 CEST	1.1.1.1	192.168.2.7	0x6089	No error (0)	pommes.hebbet.de		116.202.20.146	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:03:30.554155111 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	lintorfer.eu			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:30.554155111 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	lintorfer.eu			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:31.629719973 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	schule-studium.de			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:31.629719973 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	schule-studium.de			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:31.700397015 CEST	1.1.1.1	192.168.2.7	0xd196	No error (0)	mx2.schule-studium.de		217.13.200.22	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:03:34.618278027 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	windowspower.de			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:34.636754036 CEST	1.1.1.1	192.168.2.7	0xf99a	No error (0)	w0187a3c.kasserver.com		85.13.166.174	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:03:37.333700895 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	wirsiegen.de			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:37.333700895 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	wirsiegen.de			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:37.359704018 CEST	1.1.1.1	192.168.2.7	0x7813	No error (0)	mx04.mail.millenniumarts.net		91.198.189.25	A (IP address)	IN (0x0001)	false
Oct 17, 2024 20:03:43.400312901 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	wp.com			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:43.400312901 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	wp.com			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:44.149200916 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	guenstiger.de			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:44.149200916 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	guenstiger.de			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:44.150567055 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	games.ch			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:44.150567055 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	games.ch			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:44.151060104 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	guenstiger.de			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:44.151060104 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	guenstiger.de			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:44.187609911 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	zentrum-der-gesundheit.de			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:44.190620899 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	games.ch			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:44.190620899 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	games.ch			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:44.440144062 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	stroeerdigitalgroup.de			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:44.440144062 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	stroeerdigitalgroup.de			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:45.075118065 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	radiosantiago.cl			MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:45.234471083 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	blog.lesoir.be	redirect-lesoir.rosseltech.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 20:03:45.234471083 CEST	1.1.1.1	192.168.2.7	0x7a69	No error (0)	redirect-lesoir.rosseltech.net	fapamutp.rosseltech.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 17, 2024 20:03:47.634429932 CEST	1.1.1.1	192.168.2.7	0x7a69	Name error (3)	mozilla.org.xpi	none	none	MX (Mail exchange)	IN (0x0001)	false
Oct 17, 2024 20:03:47.644046068 CEST	1.1.1.1	192.168.2.7	0x7a69	Name error (3)	mozilla.org.xpi	none	none	MX (Mail exchange)	IN (0x0001)	false

Target ID:	0
Start time:	14:02:24
Start date:	17/10/2024
Path:	C:\Users\user\Desktop\4ui8luUSNp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\4ui8luUSNp.exe"
Imagebase:	0x400000
File size:	526'632 bytes
MD5 hash:	267B10ECA642BBC3534BE32CBC565F35
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:02:24
Start date:	17/10/2024
Path:	C:\Windows\videodrv.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\videodrv.exe
Imagebase:	0x400000
File size:	526'632 bytes
MD5 hash:	267B10ECA642BBC3534BE32CBC565F35
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000001.00000003.1503431451.0000000003523000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000001.00000003.1503431451.0000000003523000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 95%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:02:34
Start date:	17/10/2024
Path:	C:\Windows\videodrv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\videodrv.exe"
Imagebase:	0x400000
File size:	526'632 bytes
MD5 hash:	267B10ECA642BBC3534BE32CBC565F35
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000003.00000003.1555453252.0000000003CD3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Coinhive, Description: Yara detected Coinhive miner, Source: 00000003.00000003.1555453252.0000000003CD3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	14:02:43
Start date:	17/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7544 -s 18336
Imagebase:	0x7a0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.5%
Total number of Nodes:	295
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 004043D0 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 142
filelibraryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000), ref: 004043EF
GetProcAddress.KERNEL32(?,RegisterServiceProcess), ref: 00404404
WSAStartup.WSOCK32(00000001,?,kernel32.dll,00000000), ref: 00404445
GetWindowsDirectoryA.KERNEL32(00407514,00000104,00000001,?,kernel32.dll,00000000), ref: 00404477
1001F284.CRTDLL(00407618,00407514,00000104,00407514,00000104,00000001,?,kernel32.dll,00000000), ref: 0040448B
1001F218.CRTDLL(00407618,\zip.tmp,00000104,?,kernel32.dll,00000000), ref: 004044A2
DeleteFileA.KERNEL32(00407618,?,?,?,?,kernel32.dll,00000000), ref: 004044AF
1001F284.CRTDLL(0040771C,00407514,00000104,00407618,?,?,?,?,kernel32.dll,00000000), ref: 004044C3
1001F218.CRTDLL(0040771C,\exe.tmp,00000104,?,?,00407618,?,?,?,?,kernel32.dll,00000000), ref: 004044DA
DeleteFileA.KERNEL32(0040771C,?,?,?,?,?,00407618,?,?,?,?,kernel32.dll,00000000), ref: 004044E7
1001F284.CRTDLL(00407820,00407514,00000104,0040771C,?,?,?,?,?,00407618,?,?,?,?,kernel32.dll,00000000), ref: 004044FB
1001F218.CRTDLL(00407820,\eml.tmp,00000104,?,?,0040771C,?,?,?,?,?,00407618,?,?,?,?), ref: 00404512
DeleteFileA.KERNEL32(00407820,?,?,?,?,?,0040771C,?,?,?,?,?,00407618), ref: 0040451F

Part of subcall function 00404FB8: DeleteFileA.KERNEL32(0040771C,?,?,?,00404529,00407820,?,?,?,?,?,0040771C), ref: 00404FC4
Part of subcall function 00404FB8: 10015765.CRTDLL(0040771C,00474D86,0040771C,?,?,?,00404529,00407820,?,?,?,?,?,0040771C), ref: 00404FD3

Part of subcall function 00401469: 10015765.CRTDLL(0040771C,00474D86,?,?,?,?,?,00404538,0040771C,00407618,00407820), ref: 00401481

Part of subcall function 004046CD: LoadIconA.USER32(00000000,00007F00), ref: 00404710
Part of subcall function 004046CD: LoadCursorA.USER32(00000000,00007F00), ref: 00404722
Part of subcall function 004046CD: GetStockObject.GDI32(00000000), ref: 0040472F

RegisterClassA.USER32(?), ref: 00404551
CreateWindowExA.USER32(00000000,?, value,00CF0000,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00404591
MessageBoxA.USER32(00000000,Error creating window,msg,00000000), ref: 004045AD

Strings

RegisterServiceProcess, xrefs: 004043FC
kernel32.dll, xrefs: 004043EA
@G$@G(@G, xrefs: 004045F2
\zip.tmp, xrefs: 00404498
value, xrefs: 004043DA, 00404587
\eml.tmp, xrefs: 00404508
Error creating window, xrefs: 004045A6
msg, xrefs: 004045A1
\exe.tmp, xrefs: 004044D0

Memory Dump Source

Source File: 00000000.00000002.1374945102.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1374925262.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374964549.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374994306.0000000000474000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375014749.0000000000476000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375033609.0000000000478000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375052510.0000000000479000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4ui8luUSNp.jbxd

Similarity

API ID: 1001$DeleteFile$F218F284Load$10015765$AddressClassCreateCursorDirectoryIconLibraryMessageObjectProcRegisterStartupStockWindowWindows
String ID: @G$@G(@G$ value$Error creating window$RegisterServiceProcess$\eml.tmp$\exe.tmp$\zip.tmp$kernel32.dll$msg
API String ID: 4215265920-2363475753
Opcode ID: ffed2d588d9de1246e1edb8cb933916f9070d55c80b6db3eb5e96cd37b3d9b42
Instruction ID: e99ab661372d1cc03a78e8b49347f03b6722afe6656aaccac5a08a6036f0bf22
Opcode Fuzzy Hash: ffed2d588d9de1246e1edb8cb933916f9070d55c80b6db3eb5e96cd37b3d9b42
Instruction Fuzzy Hash: D34150F1E84304B6EB10BA959C47FEE76209B84B58F20043BF7047A1D2D6FD25459AAF

Function 00404E52 Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 89
registryfileprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineA.KERNEL32(?), ref: 00404E68
1001F284.CRTDLL(?,00000000,00000104,?), ref: 00404E7A
1001F284.CRTDLL(C:\Users\user\Desktop\4ui8luUSNp.exe,?,00000104,?,?,?), ref: 00404ED6
GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,?,?,?,?), ref: 00404EEA
1001E65C.CRTDLL(?,\videodrv.exe,?,00000104,?,?,?,?,?,?), ref: 00404EFB
CopyFileA.KERNEL32(?,?,00000000), ref: 00404F12
RegOpenKeyA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Run,?), ref: 00404F28
1001F200.CRTDLL(?,?,00000104,?,?,?,?,?,?), ref: 00404F34
RegSetValueExA.ADVAPI32(?,VideoDriver,00000000,00000001,?,00000000,?,?,00000104,?,?,?,?,?,?), ref: 00404F53
RegCloseKey.ADVAPI32(?,?,VideoDriver,00000000,00000001,?,00000000,?,?,00000104,?,?,?,?,?,?), ref: 00404F5E
CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000003,00000080,00000000,?,?,VideoDriver,00000000,00000001,?,00000000,?,?), ref: 00404F7C
CloseHandle.KERNEL32(000000FF,?,40000000,00000002,00000000,00000003,00000080,00000000,?,?,VideoDriver,00000000,00000001,?,00000000), ref: 00404F9D
WinExec.KERNEL32(?,00000000), ref: 00404FAB

Strings

\videodrv.exe, xrefs: 00404EEF
VideoDriver, xrefs: 00404F48
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00404F1E
", xrefs: 00404EA5
C:\Users\user\Desktop\4ui8luUSNp.exe, xrefs: 00404ED1

Memory Dump Source

Source File: 00000000.00000002.1374945102.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1374925262.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374964549.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374994306.0000000000474000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375014749.0000000000476000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375033609.0000000000478000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375052510.0000000000479000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4ui8luUSNp.jbxd

Similarity

API ID: 1001$CloseF284File$CommandCopyCreateDirectoryExecF200HandleLineOpenValueWindows
String ID: "$C:\Users\user\Desktop\4ui8luUSNp.exe$Software\Microsoft\Windows\CurrentVersion\Run$VideoDriver$\videodrv.exe
API String ID: 637561741-18291024
Opcode ID: be314feb30a0f88aeaa55c19c82bbba25c857350d4c6aaf528d1a528134497cb
Instruction ID: e0975d4760a66e87e7bcd1327159ddae44ae79f6fe7378d3e77d931f72f024fb
Opcode Fuzzy Hash: be314feb30a0f88aeaa55c19c82bbba25c857350d4c6aaf528d1a528134497cb
Instruction Fuzzy Hash: 383196B2940218A6DB20B750CC4ABDE7735AB90718F6045E9F6483A1C2C7F82FC59F99

Function 004055A4 Relevance: 4.5, APIs: 3, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineA.KERNEL32(?,?,?,00401236,00474020,00474024,00474028,00000000,00000000), ref: 004055A9
1001E69C.CRTDLL(00000001,00000022,?,?,?,00401236,00474020,00474024,00474028,00000000,00000000), ref: 004055BB
GetModuleHandleA.KERNEL32(00000000,?,?,?,00401236,00474020,00474024,00474028,00000000,00000000), ref: 004055F5

Memory Dump Source

Source File: 00000000.00000002.1374945102.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1374925262.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374964549.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374994306.0000000000474000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375014749.0000000000476000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375033609.0000000000478000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375052510.0000000000479000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4ui8luUSNp.jbxd

Similarity

API ID: 1001CommandHandleLineModule
String ID:
API String ID: 1467874914-0
Opcode ID: 9d90f70779e49901cb4a042e673f5c78066e9589dea778e10ece467b9c9a2457
Instruction ID: 2675976d44ac908319b1a546f1d7373516c9b8ec77dd3febf82d6b40b7acce9f
Opcode Fuzzy Hash: 9d90f70779e49901cb4a042e673f5c78066e9589dea778e10ece467b9c9a2457
Instruction Fuzzy Hash: E0F0C242914A8139EB3021764C06B3BA98AD792354F380833E142F62C5E9BCCD82AF2D

Function 004011CB Relevance: 3.0, APIs: 2, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

10011C28.CRTDLL(00474020,00474024,00474028,00000000,00000000), ref: 00401214

Part of subcall function 004055A4: GetCommandLineA.KERNEL32(?,?,?,00401236,00474020,00474024,00474028,00000000,00000000), ref: 004055A9
Part of subcall function 004055A4: 1001E69C.CRTDLL(00000001,00000022,?,?,?,00401236,00474020,00474024,00474028,00000000,00000000), ref: 004055BB
Part of subcall function 004055A4: GetModuleHandleA.KERNEL32(00000000,?,?,?,00401236,00474020,00474024,00474028,00000000,00000000), ref: 004055F5

10011F60.CRTDLL(00000000), ref: 0040123F

Memory Dump Source

Source File: 00000000.00000002.1374945102.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1374925262.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374964549.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374994306.0000000000474000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375014749.0000000000476000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375033609.0000000000478000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375052510.0000000000479000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4ui8luUSNp.jbxd

Similarity

API ID: 10011$1001CommandHandleLineModule
String ID:
API String ID: 3501170370-0
Opcode ID: 058b243d42634919a1932268ed5137acc044ef0ed66d9025cf1d714d917fef18
Instruction ID: fa2f8f4b5fac0dfcdecf8ccdab330e6b026f3bebebd585301074f9950c23b8aa
Opcode Fuzzy Hash: 058b243d42634919a1932268ed5137acc044ef0ed66d9025cf1d714d917fef18
Instruction Fuzzy Hash: C5F0F071980780FADB107B559E03F2A7AA8EB48B15F20412AF748A15E1D3BC50108A9E

Non-executed Functions

Function 004032D7 Relevance: 44.2, APIs: 22, Strings: 3, Instructions: 416
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CLSIDFromString.OLE32({9BA05972-F6A8-11CF-A442-00A0C90A8F39},?,00000000), ref: 00403301
1001D8F8.CRTDLL(Line %d: %s,00000084,00000000,{9BA05972-F6A8-11CF-A442-00A0C90A8F39},?,00000000), ref: 00403335
CoCreateInstance.OLE32(?,00000000,00000004,00474DDC,00000000,{9BA05972-F6A8-11CF-A442-00A0C90A8F39},?,00000000), ref: 00403362
1001D8F8.CRTDLL(Line %d: %s,0000008D,00000000,?,00000000,00000004,00474DDC,00000000,{9BA05972-F6A8-11CF-A442-00A0C90A8F39},?,00000000), ref: 00403396
1001D8F8.CRTDLL(LINE %d,00000090,?,00000000,00000004,00474DDC,00000000,{9BA05972-F6A8-11CF-A442-00A0C90A8F39},?,00000000), ref: 004033C2
1001D8F8.CRTDLL(Line %d: %s,00000093,00000000), ref: 0040341E

Strings

LINE %d, xrefs: 004033BD, 00403445, 004034E2, 00403579, 0040360A, 004036A7, 0040372F, 004037C0
{9BA05972-F6A8-11CF-A442-00A0C90A8F39}, xrefs: 004032FC
Line %d: %s, xrefs: 00403330, 00403391, 00403419, 00403498, 0040354A, 004035DB, 00403663, 00403700, 00403791, 00403819

Memory Dump Source

Source File: 00000000.00000002.1374945102.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1374925262.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374964549.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374994306.0000000000474000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375014749.0000000000476000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375033609.0000000000478000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375052510.0000000000479000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4ui8luUSNp.jbxd

Similarity

API ID: 1001$CreateFromInstanceString
String ID: LINE %d$Line %d: %s${9BA05972-F6A8-11CF-A442-00A0C90A8F39}
API String ID: 3289208521-1645282711
Opcode ID: 41b8ecf495dcfff14f3484cc832a0d0aaeb16ef57e3845268977e1bdf1219094
Instruction ID: a9b72692392feb8c2838df239970aa052233eb83172fa1581b79b1dcfda1a31f
Opcode Fuzzy Hash: 41b8ecf495dcfff14f3484cc832a0d0aaeb16ef57e3845268977e1bdf1219094
Instruction Fuzzy Hash: 7BF1A3B2D04204ABEB10AF51CD06BEE7A78EB84706F2040BAE504372D1D7BD5F85DB5A

Function 00401469 Relevance: 43.9, APIs: 23, Strings: 2, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

10015765.CRTDLL(0040771C,00474D86,?,?,?,?,?,00404538,0040771C,00407618,00407820), ref: 00401481
10015765.CRTDLL(00407618,00474D83,?,?,?,?,?,?,00404538,0040771C,00407618), ref: 004014A4

Strings

message.html, xrefs: 00401470
8E@, xrefs: 00401560

Memory Dump Source

Source File: 00000000.00000002.1374945102.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1374925262.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374964549.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374994306.0000000000474000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375014749.0000000000476000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375033609.0000000000478000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375052510.0000000000479000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4ui8luUSNp.jbxd

Similarity

API ID: 10015765
String ID: 8E@$message.html
API String ID: 627249555-2872700593
Opcode ID: 23e158315ef81f948e1bc13286fc1c995ca378cdf279cd907a673e7abb40ef99
Instruction ID: 32b62223590821d90bdf4fd44950fa7710351775f328ad968971fbda23096aff
Opcode Fuzzy Hash: 23e158315ef81f948e1bc13286fc1c995ca378cdf279cd907a673e7abb40ef99
Instruction Fuzzy Hash: 736130B2D14204EADF10AF95DD02BAF7B72EF54704F144079E504362E1E3BA2A64DF9A

Function 00402C3E Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 102
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

1001F200.CRTDLL(?), ref: 00402C4B
1001F284.CRTDLL(?,?,000000FA), ref: 00402C6E
1001F284.CRTDLL(00407ED0,?,00000104), ref: 00402C83
1001E65C.CRTDLL(?,*.*), ref: 00402C97
FindFirstFileA.KERNEL32(?,?), ref: 00402CAD
1001E6C4.CRTDLL(?,00474A69,?,?), ref: 00402CDC
1001E6C4.CRTDLL(?,00474A66,?,?), ref: 00402CF9
1001E660.CRTDLL(?,?,?,?,?,?), ref: 00402D14
1001E65C.CRTDLL(?,?,?,?,?,?,?,?), ref: 00402D2A
1001E65C.CRTDLL(?,00474A64,?,?,?,?,?,?,?,?), ref: 00402D3E
FindNextFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00402DB7

Strings

*.*, xrefs: 00402C8B
%s%s, xrefs: 00402D8B

Memory Dump Source

Source File: 00000000.00000002.1374945102.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1374925262.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374964549.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374994306.0000000000474000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375014749.0000000000476000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375033609.0000000000478000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375052510.0000000000479000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4ui8luUSNp.jbxd

Similarity

API ID: 1001$F284FileFind$E660F200FirstNext
String ID: %s%s$*.*
API String ID: 1948946466-705776850
Opcode ID: d38d8e587c359fe16ca7e2567f7d8e2feb1714031e55fecf5a30c112bc74cace
Instruction ID: ddcd00cabe306baeb2a3d3c24980d469963555bf3affe5bc13603fede52dfb5b
Opcode Fuzzy Hash: d38d8e587c359fe16ca7e2567f7d8e2feb1714031e55fecf5a30c112bc74cace
Instruction Fuzzy Hash: 6431E573C00219A6CB217A009D0BBEE7235DBC4704F4104BAF60C761C2D7B92B9A9E9B

Function 004045FA Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 69threadnativetimeCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,00404932,00000000,00000000,?), ref: 00404638
KillTimer.USER32(?,00000001), ref: 0040464C
gethostbyname.WSOCK32(www.google.com,?,00000001), ref: 00404656
CreateThread.KERNEL32(00000000,00000000,00404751,00000000,00000000,?), ref: 00404671
CreateThread.KERNEL32(00000000,00000000,h`,00000000,00000000,?), ref: 00404687
CreateThread.KERNEL32(00000000,00000000,00404BDE,00000000,00000000,?), ref: 0040469D
PostQuitMessage.USER32(00000000), ref: 004046AB
NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 004046C3

Strings

www.google.com, xrefs: 00404651
h`, xrefs: 0040467E

Memory Dump Source

Source File: 00000000.00000002.1374945102.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1374925262.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374964549.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374994306.0000000000474000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375014749.0000000000476000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375033609.0000000000478000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375052510.0000000000479000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4ui8luUSNp.jbxd

Similarity

API ID: CreateThread$KillMessageNtdllPostProc_QuitTimerWindowgethostbyname
String ID: h`$www.google.com
API String ID: 4207061589-1147896248
Opcode ID: 6c5bec7ba190cf5f0a4628c6c1ab159bf887b29402b6a3e017fb3ace398f63ce
Instruction ID: 09e2b1a2ec863ca34a71cd6057943918fb5172a7d91df02ac762c8cedf36b740
Opcode Fuzzy Hash: 6c5bec7ba190cf5f0a4628c6c1ab159bf887b29402b6a3e017fb3ace398f63ce
Instruction Fuzzy Hash: BB1130713C0704B5EE306A458C07F9E26629BC2F06F21483BB3043E1D092FEA951AA5E

Function 00403FB6 Relevance: 94.8, APIs: 41, Strings: 13, Instructions: 279
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

1001E69C.CRTDLL(?,00000040), ref: 00403FC9
1001D8F8.CRTDLL(Domain: '%s',00000001), ref: 00403FF2

Part of subcall function 0040241C: 1001F200.CRTDLL(00000000,?,?,?,00401DD4,?,?,000007D0,00000000,00000000,?,?,000000FF,?,?,000000FF), ref: 0040242E
Part of subcall function 0040241C: RtlZeroMemory.KERNEL32(?,00000200), ref: 00402457
Part of subcall function 0040241C: RtlZeroMemory.KERNEL32(?,00002800,?,00000200), ref: 00402468
Part of subcall function 0040241C: RtlZeroMemory.KERNEL32(?,00000100,?,00002800,?,00000200), ref: 00402479
Part of subcall function 0040241C: socket.WSOCK32(00000002,00000001,00000006,?,00000100,?,00002800,?,00000200), ref: 00402484
Part of subcall function 0040241C: htons.WSOCK32(00000035,00000002,00000001,00000006,?,00000100,?,00002800,?,00000200), ref: 004024B2
Part of subcall function 0040241C: 1001C489.CRTDLL(00000800,00000035,00000002,00000001,00000006,?,00000100,?,00002800,?,00000200), ref: 004024C5
Part of subcall function 0040241C: RtlZeroMemory.KERNEL32(?,00000004), ref: 004024E6
Part of subcall function 0040241C: GetNetworkParams.IPHLPAPI(?,00000800), ref: 004024F8
Part of subcall function 0040241C: closesocket.WSOCK32(000000FF,?,00000004), ref: 0040250F

1001D8F8.CRTDLL(MX: '%s',?), ref: 00404027
1001D8F8.CRTDLL(Lookup failed), ref: 00404036
gethostbyname.WSOCK32(?), ref: 00404056
WSAGetLastError.WSOCK32 ref: 0040406A
1001D8F8.CRTDLL(hostent() error: %d,00000000), ref: 00404077
socket.WSOCK32(00000002,00000001,00000006), ref: 0040408F
htons.WSOCK32(00000019), ref: 004040C9
connect.WSOCK32(000000FF,00000002,00000010,00000019), ref: 004040EF
1001F200.CRTDLL(HELO localhost,?), ref: 0040410D
send.WSOCK32(000000FF,HELO localhost,00000000,00000000,?,?), ref: 00404122
closesocket.WSOCK32(000000FF,00000000,?,?), ref: 0040413A

Strings

Domain: '%s', xrefs: 00403FED
From: %sTo: <%s>Reply-To: <%s>Subject: %s, xrefs: 0040426A
DATA, xrefs: 004041FD, 0040420F
QUIT, xrefs: 00404353, 00404365
., xrefs: 00404315, 00404327
%s %d, xrefs: 00404247
hostent() error: %d, xrefs: 00404072
MAIL FROM:<%s>, xrefs: 0040414C
HELO localhost, xrefs: 00404108, 0040411A
MX: '%s', xrefs: 00404022
RCPT TO:<%s>, xrefs: 004041A6
Lookup failed, xrefs: 00404031
Failed to connect: '%s', xrefs: 00404398

Memory Dump Source

Source File: 00000000.00000002.1374945102.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1374925262.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374964549.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374994306.0000000000474000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375014749.0000000000476000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375033609.0000000000478000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375052510.0000000000479000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4ui8luUSNp.jbxd

Similarity

API ID: 1001$MemoryZero$F200closesockethtonssocket$C489ErrorLastNetworkParamsconnectgethostbynamesend
String ID: .$%s %d$DATA$Domain: '%s'$Failed to connect: '%s'$From: %sTo: <%s>Reply-To: <%s>Subject: %s$HELO localhost$Lookup failed$MAIL FROM:<%s>$MX: '%s'$QUIT$RCPT TO:<%s>$hostent() error: %d
API String ID: 1190693670-3956985911
Opcode ID: 38e472f5afb0dfda48cfd1dd65f6b42815a48a5cb7d39b726019f355f5181a31
Instruction ID: 7bc473aee1d268b799f7e717c2b6871404de3c613b830544c2f882715362dada
Opcode Fuzzy Hash: 38e472f5afb0dfda48cfd1dd65f6b42815a48a5cb7d39b726019f355f5181a31
Instruction Fuzzy Hash: 26A1B2B2940218FADB20AA518C07BDE7631DB90704F2044BAFA04361D1D7B95FA5AE9E

Function 00401E58 Relevance: 66.7, APIs: 31, Strings: 7, Instructions: 230
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

gethostbyname.WSOCK32(00401E07,?,?,?,00401E07), ref: 00401E7D
socket.WSOCK32(00000002,00000001,00000006,00401E07,?), ref: 00401E9B
htons.WSOCK32(00000019), ref: 00401EE3
connect.WSOCK32(000000FF,00000002,00000010,00000019), ref: 00401F09
1001F200.CRTDLL(HELO localhost), ref: 00401F27
send.WSOCK32(000000FF,HELO localhost,00000000,00000000), ref: 00401F3C
closesocket.WSOCK32(000000FF,00000000), ref: 00401F54

Strings

RCPT TO:<%s>, xrefs: 00401FD8
DATA, xrefs: 0040202F, 00402041
QUIT, xrefs: 00402179, 0040218B
., xrefs: 0040213B, 0040214D
MAIL FROM:<%s>, xrefs: 00401F72
HELO localhost, xrefs: 00401F22, 00401F34
From: %sTo: %sReply-To: %s, xrefs: 0040208F

Memory Dump Source

Source File: 00000000.00000002.1374945102.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1374925262.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374964549.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374994306.0000000000474000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375014749.0000000000476000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375033609.0000000000478000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375052510.0000000000479000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4ui8luUSNp.jbxd

Similarity

API ID: 1001F200closesocketconnectgethostbynamehtonssendsocket
String ID: .$DATA$From: %sTo: %sReply-To: %s$HELO localhost$MAIL FROM:<%s>$QUIT$RCPT TO:<%s>
API String ID: 3792293338-119287665
Opcode ID: 6edecf961497a81c2509e9009f622c32a04d8440bcf6d91d1fdcd2db56ac74ee
Instruction ID: c789c2ceb8872c264f61e6111112c3e2041cb94a0bf67aabb908bc6aa9ac6a0c
Opcode Fuzzy Hash: 6edecf961497a81c2509e9009f622c32a04d8440bcf6d91d1fdcd2db56ac74ee
Instruction Fuzzy Hash: 6A918072C40144FADB11AB519D06BDE7636EB80308F2040BBF504361E1E7B9AF99AE9D

Function 0040241C Relevance: 63.3, APIs: 34, Strings: 2, Instructions: 299
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

1001F200.CRTDLL(00000000,?,?,?,00401DD4,?,?,000007D0,00000000,00000000,?,?,000000FF,?,?,000000FF), ref: 0040242E
RtlZeroMemory.KERNEL32(?,00000200), ref: 00402457
RtlZeroMemory.KERNEL32(?,00002800,?,00000200), ref: 00402468
RtlZeroMemory.KERNEL32(?,00000100,?,00002800,?,00000200), ref: 00402479
socket.WSOCK32(00000002,00000001,00000006,?,00000100,?,00002800,?,00000200), ref: 00402484
htons.WSOCK32(00000035,00000002,00000001,00000006,?,00000100,?,00002800,?,00000200), ref: 004024B2
1001C489.CRTDLL(00000800,00000035,00000002,00000001,00000006,?,00000100,?,00002800,?,00000200), ref: 004024C5
RtlZeroMemory.KERNEL32(?,00000004), ref: 004024E6
GetNetworkParams.IPHLPAPI(?,00000800), ref: 004024F8
closesocket.WSOCK32(000000FF,?,00000004), ref: 0040250F
inet_addr.WSOCK32(212.5.86.163,?,00000004), ref: 00402523
ioctlsocket.WSOCK32(000000FF,80040000,00000001,212.5.86.163,?,00000004), ref: 004025A9
connect.WSOCK32(000000FF,?,00000010,000000FF,80040000,00000001,212.5.86.163,?,00000004), ref: 004025BA
WSAGetLastError.WSOCK32(000000FF,?,00000010,000000FF,80040000,00000001,212.5.86.163,?,00000004), ref: 004025C8
select.WSOCK32(00000000,00000000,00000040,00000000,?,000000FF,?,00000010,000000FF,80040000,00000001,212.5.86.163,?,00000004), ref: 0040263E
ioctlsocket.WSOCK32(000000FF,80040000,00000000,000000FF,?,00000010,000000FF,80040000,00000001,212.5.86.163,?,00000004), ref: 0040266C
closesocket.WSOCK32(000000FF), ref: 00402698

Strings

212.5.86.163, xrefs: 0040251E
@, xrefs: 004025DE

Memory Dump Source

Source File: 00000000.00000002.1374945102.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1374925262.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374964549.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374994306.0000000000474000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375014749.0000000000476000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375033609.0000000000478000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375052510.0000000000479000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4ui8luUSNp.jbxd

Similarity

API ID: MemoryZero$1001closesocketioctlsocket$C489ErrorF200LastNetworkParamsconnecthtonsinet_addrselectsocket
String ID: 212.5.86.163$@
API String ID: 3216102798-3789070369
Opcode ID: 6875aea6d2ad78f97dfe295fe13181fa33d898ee8b5da3e3c306c13944ff61f5
Instruction ID: 0850302d7e0a7daca668ae12596435e0ce83fecd31ecfc9c58567dc193e4777b
Opcode Fuzzy Hash: 6875aea6d2ad78f97dfe295fe13181fa33d898ee8b5da3e3c306c13944ff61f5
Instruction Fuzzy Hash: 0FD14D72D01228EAEF39AB118D0DB9EB772EB84714F1104EAE508371D0CBB85F959F59

Function 00403976 Relevance: 51.1, APIs: 24, Strings: 5, Instructions: 383
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

1001D8F8.CRTDLL(LINE %d,000000EC,?,00000002), ref: 00403999
1001D8F8.CRTDLL(Line %d: %s,000000EE,00000000), ref: 004039EC

Strings

value, xrefs: 00403EFD
LINE %d, xrefs: 00403994, 00403A13, 00403AA9, 00403AE1, 00403B69, 00403BE8, 00403C68, 00403CE7, 00403D33, 00403DD0, 00403E6F
Z9@, xrefs: 00403C7F, 00403BFF, 00403C02, 00403C82
Z9@, xrefs: 00403D02, 00403D6C
Line %d: %s, xrefs: 004039E7, 00403A66, 00403B3D, 00403BBC, 00403C3C, 00403CBB, 00403DA4, 00403E2C

Memory Dump Source

Source File: 00000000.00000002.1374945102.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1374925262.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374964549.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374994306.0000000000474000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375014749.0000000000476000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375033609.0000000000478000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375052510.0000000000479000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4ui8luUSNp.jbxd

Similarity

API ID: 1001
String ID: value$LINE %d$Line %d: %s$Z9@$Z9@
API String ID: 3273692033-4119484769
Opcode ID: 773c32fa49ed7cbcf79018bf3290a0453b83e0c3fcd27ffda7bd2550a0372985
Instruction ID: c92c99cda2f92db92eeca4ed6438e44f586066a9280843e6fb57d98702687c43
Opcode Fuzzy Hash: 773c32fa49ed7cbcf79018bf3290a0453b83e0c3fcd27ffda7bd2550a0372985
Instruction Fuzzy Hash: FDE19F72D04205EBEB00AF91C8067EEBA79EB84706F24403AE504772D1D7BD6F85DB5A

Function 00404FB8 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 75
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNEL32(0040771C,?,?,?,00404529,00407820,?,?,?,?,?,0040771C), ref: 00404FC4
10015765.CRTDLL(0040771C,00474D86,0040771C,?,?,?,00404529,00407820,?,?,?,?,?,0040771C), ref: 00404FD3
1001C06C.CRTDLL(00000000,MIME-Version: 1.0Content-Location:File://foo.exeContent-Transfer-Encoding: binary,0040771C,?,?,?,00404529), ref: 00404FF6
10015765.CRTDLL(C:\Users\user\Desktop\4ui8luUSNp.exe,00474D83,?,?,0040771C,?,?,?,00404529), ref: 00405008

Strings

<body bgcolor=black scroll=no><SCRIPT>function malware(){s=document.URL;path=s.substr(-0,s.lastIndexOf("\\"));path=unescape(path);document.write(' <title>Message</title><body scroll=no bgcolor=white><FONT face="Arial" color=black style="position:absolute, xrefs: 00405099
MIME-Version: 1.0Content-Location:File://foo.exeContent-Transfer-Encoding: binary, xrefs: 00404FEE
C:\Users\user\Desktop\4ui8luUSNp.exe, xrefs: 00405003

Memory Dump Source

Source File: 00000000.00000002.1374945102.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1374925262.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374964549.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374994306.0000000000474000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375014749.0000000000476000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375033609.0000000000478000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375052510.0000000000479000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4ui8luUSNp.jbxd

Similarity

API ID: 10015765$1001DeleteFile
String ID: <body bgcolor=black scroll=no><SCRIPT>function malware(){s=document.URL;path=s.substr(-0,s.lastIndexOf("\\"));path=unescape(path);document.write(' <title>Message</title><body scroll=no bgcolor=white><FONT face="Arial" color=black style="position:absolute$C:\Users\user\Desktop\4ui8luUSNp.exe$MIME-Version: 1.0Content-Location:File://foo.exeContent-Transfer-Encoding: binary
API String ID: 3647878303-1969695888
Opcode ID: e632037a8f5f3fbd7fc21e7fc52ccf075609a80f30cba8ccbec56cf1c5b99f61
Instruction ID: a5c8f9776a4e9eb507219238b69814b4e58edb9589292bb17a273115fcafa01f
Opcode Fuzzy Hash: e632037a8f5f3fbd7fc21e7fc52ccf075609a80f30cba8ccbec56cf1c5b99f61
Instruction Fuzzy Hash: 1D2133B2D00508FBDF117695DC06BAE7A31DB50308F148476F904351E1E7BA5A649E8A

Function 00402E85 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 102
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00402DC8: 1001F200.CRTDLL(00000000,?), ref: 00402DE3

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,?), ref: 00402EBD
GetFileSize.KERNEL32(00000000,00000000,00000000,80000000,00000001,00000000,00000003,00000080,00000000,?), ref: 00402EDD
CloseHandle.KERNEL32(00000000,00000000,00000000,00000000,80000000,00000001,00000000,00000003,00000080,00000000,?), ref: 00402EF0

Strings

Failed to open '%s', xrefs: 00402FF1
Read error, xrefs: 00402F3E
Memory allocation error, file %s, size %d, xrefs: 00402FD7

Memory Dump Source

Source File: 00000000.00000002.1374945102.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1374925262.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374964549.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374994306.0000000000474000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375014749.0000000000476000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375033609.0000000000478000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375052510.0000000000479000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4ui8luUSNp.jbxd

Similarity

API ID: File$1001CloseCreateF200HandleSize
String ID: Failed to open '%s'$Memory allocation error, file %s, size %d$Read error
API String ID: 1543754479-2966797669
Opcode ID: 26654996f537e94b6437c2a4dd3c47e5c29a479cbf154200ddb46358a34ba03f
Instruction ID: 4bf70c94a4caf8dd1b67910f9586562c8b01bb5aef2dca292cb34115e63c2259
Opcode Fuzzy Hash: 26654996f537e94b6437c2a4dd3c47e5c29a479cbf154200ddb46358a34ba03f
Instruction Fuzzy Hash: 4A3152B1C04105AAEF116B91DE0ABAE7A31AB40308F24443BF505351F1D7BA5A65FE9F

Function 00404932 Relevance: 24.2, APIs: 16, Instructions: 165
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

1001E65C.CRTDLL(00000000,?), ref: 00404965
1001E65C.CRTDLL(00000000,?), ref: 0040498F
1001E65C.CRTDLL(00000000,?), ref: 004049B9
1001E65C.CRTDLL(00000000,?), ref: 004049EA
1001E65C.CRTDLL(00000000,?), ref: 00404A14

Part of subcall function 00405100: 1001E660.CRTDLL(41C60EEF,?,?), ref: 004051FE

1001E65C.CRTDLL(00000000,?), ref: 00404A3E
1001E65C.CRTDLL(00000000,?), ref: 00404A6F
1001E65C.CRTDLL(00000000,?), ref: 00404A99
1001E65C.CRTDLL(00000000,?), ref: 00404AC3
1001E65C.CRTDLL(00000000,?), ref: 00404AF4
1001E65C.CRTDLL(00000000,?), ref: 00404B1E
1001E65C.CRTDLL(00000000,?), ref: 00404B48
1001E660.CRTDLL(00407A88,00000000), ref: 00404B5C
1001E660.CRTDLL(00407B88,00000000), ref: 00404B70
1001E660.CRTDLL(00407C88,00000000), ref: 00404B84
1001E660.CRTDLL(00407D88,00000000), ref: 00404B98

Memory Dump Source

Source File: 00000000.00000002.1374945102.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1374925262.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374964549.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374994306.0000000000474000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375014749.0000000000476000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375033609.0000000000478000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375052510.0000000000479000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4ui8luUSNp.jbxd

Similarity

API ID: 1001$E660
String ID:
API String ID: 711195432-0
Opcode ID: ca1bc1fb306098ab6712920d321c79089bc6ac382dc23313e8dfca4a2aba109b
Instruction ID: f08960fdd85e455d33e7b90b9d7183b5d218ef389d24f7a66b72040e99619d9f
Opcode Fuzzy Hash: ca1bc1fb306098ab6712920d321c79089bc6ac382dc23313e8dfca4a2aba109b
Instruction Fuzzy Hash: DE51467BC0051456CB21AA415C06BEF7239ABD9704F8908EDF908B6142D3F4279ACFF6

Function 00404751 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 110
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32(000005DC), ref: 0040475C
GetWindowTextA.USER32(00000000,?,000000FF), ref: 00404770
Sleep.KERNEL32(000001F4,?,000000FF,000005DC), ref: 004047AA

Part of subcall function 004031F6: GetTickCount.KERNEL32 ref: 00403222
Part of subcall function 004031F6: CoInitialize.OLE32(00000000), ref: 0040322E
Part of subcall function 004031F6: GetTickCount.KERNEL32 ref: 004032B1
Part of subcall function 004031F6: CoUninitialize.OLE32 ref: 004032CA

Part of subcall function 00401A58: GetTickCount.KERNEL32 ref: 00401A61
Part of subcall function 00401A58: 1001F284.CRTDLL(?,?,000000FF,?,?,?,?,?,004017DB,?,00000000), ref: 00401B6F

Part of subcall function 00403FB6: 1001E69C.CRTDLL(?,00000040), ref: 00403FC9
Part of subcall function 00403FB6: 1001D8F8.CRTDLL(Domain: '%s',00000001), ref: 00403FF2
Part of subcall function 00403FB6: 1001D8F8.CRTDLL(MX: '%s',?), ref: 00404027
Part of subcall function 00403FB6: gethostbyname.WSOCK32(?), ref: 00404056
Part of subcall function 00403FB6: WSAGetLastError.WSOCK32 ref: 0040406A
Part of subcall function 00403FB6: 1001D8F8.CRTDLL(hostent() error: %d,00000000), ref: 00404077

DeleteFileA.KERNEL32(c:\tmpe.tmp,?,?,?,?,?,?,?,?,?,000001F4,?,000000FF,000005DC), ref: 0040480F
Sleep.KERNEL32(001B7740,c:\tmpe.tmp,?,?,?,?,?,?,?,?,?,000001F4,?,000000FF,000005DC), ref: 00404819
1001F200.CRTDLL(?), ref: 0040482A
DeleteFileA.KERNEL32(c:\tmpe.tmp), ref: 004048E3
Sleep.KERNEL32(001B7740,c:\tmpe.tmp), ref: 004048ED
1001F200.CRTDLL(?), ref: 00404901
Sleep.KERNEL32(000005DC), ref: 0040491F

Strings

c:\tmpe.tmp, xrefs: 004047DF, 004047FD, 0040480A, 004048B3, 004048D1, 004048DE

Memory Dump Source

Source File: 00000000.00000002.1374945102.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1374925262.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374964549.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374994306.0000000000474000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375014749.0000000000476000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375033609.0000000000478000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375052510.0000000000479000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4ui8luUSNp.jbxd

Similarity

API ID: 1001$Sleep$CountTick$DeleteF200FileWindow$ErrorF284ForegroundInitializeLastTextUninitializegethostbyname
String ID: c:\tmpe.tmp
API String ID: 3006756165-1120852642
Opcode ID: e6cd1612c391d8b5ab87c07806a8b57ef9ab1add1e89a9206d0ee0a6911d9fed
Instruction ID: 109c13d56edc1a309cbd2493eb2c6e9320dcd9141e0ba1de7d1749050c8eb415
Opcode Fuzzy Hash: e6cd1612c391d8b5ab87c07806a8b57ef9ab1add1e89a9206d0ee0a6911d9fed
Instruction Fuzzy Hash: DF41B6F2D8431496D7207A614C4BBAA7634ABE0705F5004FBF608361C2D7BC2B859EAF

Function 0040171A Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

10015765.CRTDLL(?,00474D83), ref: 0040172C
100151BB.CRTDLL(00000000), ref: 0040174A
10015138.CRTDLL(00000000), ref: 00401755
1001C489.CRTDLL(?), ref: 00401763

Strings

X-Mailer: The Bat! (v1.61)X-Priority: 2 (High)Subject: your account %sMIME-Version: 1.0Content-Type: multipart/mixed; boundary="%s"--%sContent-Type: text/plain; charset=us-asciiContent-Transfer-Encoding: 7bitHello there,I w, xrefs: 0040181F

Memory Dump Source

Source File: 00000000.00000002.1374945102.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1374925262.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374964549.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374994306.0000000000474000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375014749.0000000000476000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375033609.0000000000478000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375052510.0000000000479000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4ui8luUSNp.jbxd

Similarity

API ID: 10011001511001513810015765C489
String ID: X-Mailer: The Bat! (v1.61)X-Priority: 2 (High)Subject: your account %sMIME-Version: 1.0Content-Type: multipart/mixed; boundary="%s"--%sContent-Type: text/plain; charset=us-asciiContent-Transfer-Encoding: 7bitHello there,I w
API String ID: 1519618610-3261467570
Opcode ID: 534fb217c0a01ac4c1c9b0ee8eef981cce3537bfa5c8f9e67ea7be1c92fb8f7a
Instruction ID: f58ab0c008a33dd4d7cd281d08e78b24797d05f7c4658de05cd3826ba623b4ed
Opcode Fuzzy Hash: 534fb217c0a01ac4c1c9b0ee8eef981cce3537bfa5c8f9e67ea7be1c92fb8f7a
Instruction Fuzzy Hash: E73180B7C00108ABDF11BB519C02BDE7735EB54308F0084BAE909361A1E3B92BA5DF96

Function 00402946 Relevance: 18.1, APIs: 12, Instructions: 128COMMON

Download Yara Rule

APIs

1001F200.CRTDLL(?,?,000000FF), ref: 00402952
1001F200.CRTDLL(?), ref: 00402974

Memory Dump Source

Source File: 00000000.00000002.1374945102.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1374925262.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374964549.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374994306.0000000000474000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375014749.0000000000476000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375033609.0000000000478000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375052510.0000000000479000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4ui8luUSNp.jbxd

Similarity

API ID: 1001F200
String ID:
API String ID: 2081591043-0
Opcode ID: 0da828a5028cfb9c4bdee7d9b70c61f080903027bfc2c847c8062276e403e7c4
Instruction ID: 7713d44a492a5678a5425cf20fc7b15ee69cf14a5256b58bb3988463bdbd0874
Opcode Fuzzy Hash: 0da828a5028cfb9c4bdee7d9b70c61f080903027bfc2c847c8062276e403e7c4
Instruction Fuzzy Hash: 0D519E72D00209EBDF109F94D9097DFBB72EF85328F254065E8043B291D7B9AB46CB99

Function 00401C21 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 147sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 00401C35
1001F284.CRTDLL(?,00000000,admin@,000000FF,000003E8), ref: 00401C5A
1001F218.CRTDLL(?,?,00000000,000000F5,000003E8), ref: 00401C85
1001F284.CRTDLL(?,?,00000000,000000FF,?,?,000000F5,000003E8), ref: 00401CB0
1001E69C.CRTDLL(?,00000000,00000040,?,?,000000FF,?,?,000000F5,000003E8), ref: 00401CD0
1001F218.CRTDLL(?,00000000,00474AF5,000000FF,00000000,?,00000040,?,?,000000FF,?,?,000000F5,000003E8), ref: 00401D38
1001F218.CRTDLL(?,?,00000000,000000FF,?,000000FF,00000000,?,00000040,?,?,000000FF,?,?,000000F5,000003E8), ref: 00401D63
1001F218.CRTDLL(?,00000000,00474AF3,000000FF,?,?,000000FF,?,000000FF,00000000,?,00000040,?,?,000000FF), ref: 00401D8B
1001F200.CRTDLL(?,00000000,?,?,?,00000000,?,?,000000FF,?,?,000000FF,?,000000FF,00000000), ref: 00401DF2

Strings

admin@, xrefs: 00401C3F

Memory Dump Source

Source File: 00000000.00000002.1374945102.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1374925262.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374964549.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374994306.0000000000474000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375014749.0000000000476000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375033609.0000000000478000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375052510.0000000000479000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4ui8luUSNp.jbxd

Similarity

API ID: 1001$F218$F284$F200Sleep
String ID: admin@
API String ID: 3533001665-489714713
Opcode ID: 26f80d246675fff50ab745c3a5902f9ab7e66177db87522a5013fd4d99381f66
Instruction ID: 195e9dc06b422f6bd718f6be3a99c537dc1a5c0d43a746e2b0d35170f5ee9495
Opcode Fuzzy Hash: 26f80d246675fff50ab745c3a5902f9ab7e66177db87522a5013fd4d99381f66
Instruction Fuzzy Hash: 6F51B3B5D0020AEBDB009F44DD417DE7B75FB95324F24003AE90477292E3B9AA868FD9

Function 004022F2 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 80COMMON

Download Yara Rule

APIs

6FF31E40.WSOCK32(00000000,000000FF,00000001,00000000,00000002,00000000), ref: 0040235B
select.WSOCK32(00000000,00000001,00000000,00000000,00000003,00000000,000000FF,00000001,00000000,00000002,00000000), ref: 00402377
1001F24C.CRTDLL(?,250,00000003,00000000,00000001,00000000,00000000,00000003,00000000,000000FF,00000001,00000000,00000002,00000000), ref: 004023AE
1001F24C.CRTDLL(?,220,00000003,00000000,00000002,00000000), ref: 004023C9
1001F24C.CRTDLL(?,354,00000003,?,?,?,00000000,00000002,00000000), ref: 004023E4
1001F24C.CRTDLL(?,221,00000003,?,?,?,?,?,?,00000000,00000002,00000000), ref: 004023FF

Strings

354, xrefs: 004023D8
221, xrefs: 004023F3
220, xrefs: 004023BD
250, xrefs: 004023A2

Memory Dump Source

Source File: 00000000.00000002.1374945102.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1374925262.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374964549.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374994306.0000000000474000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375014749.0000000000476000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375033609.0000000000478000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375052510.0000000000479000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4ui8luUSNp.jbxd

Similarity

API ID: 1001$select
String ID: 220$221$250$354
API String ID: 1275355861-4259334579
Opcode ID: 7cb3f69c7fc8c38a19d4e74e1a1af09580e14dc2ca8146732558e38d4466212d
Instruction ID: 7a5b8caf8da70b3089f469a0b26dd38df3b0f8160f7480a1966fa1a1baa37f93
Opcode Fuzzy Hash: 7cb3f69c7fc8c38a19d4e74e1a1af09580e14dc2ca8146732558e38d4466212d
Instruction Fuzzy Hash: EA314C71940218EADB219B41DC467DEBB79EB81714F1080A6E6087B2C1C3F96BC6CF95

Function 00404BDE Relevance: 15.1, APIs: 10, Instructions: 114sleepnetworkCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000EA60), ref: 00404BEF
10015765.CRTDLL(00407820,00474803,0000EA60), ref: 00404C07
WSAStartup.WSOCK32(00000001,?), ref: 00404C2B
RtlZeroMemory.KERNEL32(004082E0,00061C00,00000001,?), ref: 00404C49
1001BD6D.CRTDLL(00000000,004082E0,00061C00,00000001,?), ref: 00404DF3

Memory Dump Source

Source File: 00000000.00000002.1374945102.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1374925262.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374964549.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374994306.0000000000474000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375014749.0000000000476000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375033609.0000000000478000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375052510.0000000000479000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4ui8luUSNp.jbxd

Similarity

API ID: 100110015765MemorySleepStartupZero
String ID:
API String ID: 499941085-0
Opcode ID: abef3d57c3958584e0eba9587ac1eba7095b698237b23cff4d6d4070dc39c0ae
Instruction ID: ecc6d551da77e7d28809b25a000f7eb96683d12bf15382b1ef3cc4d435574783
Opcode Fuzzy Hash: abef3d57c3958584e0eba9587ac1eba7095b698237b23cff4d6d4070dc39c0ae
Instruction Fuzzy Hash: F841B1B1905208DAEB209B51EE4679A7771FB81318F61007AE2443B1E1D7B86985CF9E

Function 00403001 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,?), ref: 0040303A
1001F200.CRTDLL(?,?,00000000,?,00000200,00000000,?,?,00000200,80000001,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,?), ref: 00403051
1001E65C.CRTDLL(0000005C,00474A64), ref: 00403074
RegEnumValueA.ADVAPI32(?,00000000,?,00000200,00000000,?,?,00000200,80000001,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,?), ref: 004030D6
RegCloseKey.ADVAPI32(?,80000001,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,?), ref: 004030EA

Strings

\, xrefs: 0040305E
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 00403030

Memory Dump Source

Source File: 00000000.00000002.1374945102.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1374925262.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374964549.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374994306.0000000000474000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375014749.0000000000476000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375033609.0000000000478000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375052510.0000000000479000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4ui8luUSNp.jbxd

Similarity

API ID: 1001$CloseEnumF200OpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders$\
API String ID: 846793889-2371276724
Opcode ID: d77d8edebdf5d7138e72573bbf5c914790a1234c6a7042f551b9ceea9c34f7ac
Instruction ID: 7e819d6c7fad4c3be6966f053a9d0f3ef23f91f33627878e8c4f75e928424671
Opcode Fuzzy Hash: d77d8edebdf5d7138e72573bbf5c914790a1234c6a7042f551b9ceea9c34f7ac
Instruction Fuzzy Hash: 351184B280031C9AEB30AB518C4DBDFB779AB80704F0445E9E62976193C7B81BC9CF95

Function 00402DC8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

1001F200.CRTDLL(00000000,?), ref: 00402DE3
1001F200.CRTDLL(00000000), ref: 00402E04
1001F284.CRTDLL(00000000,?,00000003), ref: 00402E2F

Strings

, xrefs: 00402E59, 00402E5C
[JG, xrefs: 00402DD3

Memory Dump Source

Source File: 00000000.00000002.1374945102.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1374925262.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374964549.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374994306.0000000000474000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375014749.0000000000476000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375033609.0000000000478000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375052510.0000000000479000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4ui8luUSNp.jbxd

Similarity

API ID: 1001$F200$F284
String ID: $[JG
API String ID: 115559359-959137364
Opcode ID: b70f47711542b54cba988c404015f4c87fc1533eb41b6277ef0bff049ad6453a
Instruction ID: 3b8af29cb0cfe4db57d817593d7373748dedf92242b3a25f04056baa53a85c6b
Opcode Fuzzy Hash: b70f47711542b54cba988c404015f4c87fc1533eb41b6277ef0bff049ad6453a
Instruction Fuzzy Hash: 4B1160B5800249EBDF019B94D9057DE7B72EB40318F110066DD053F2D2C3B96B4AABC6

Function 004031F6 Relevance: 10.6, APIs: 7, Instructions: 55COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403222
CoInitialize.OLE32(00000000), ref: 0040322E
1001E6C4.CRTDLL(?,?), ref: 00403271
1001D340.CRTDLL(?,?,00000FFF), ref: 004032A0
GetTickCount.KERNEL32 ref: 004032B1
CoUninitialize.OLE32 ref: 004032CA

Memory Dump Source

Source File: 00000000.00000002.1374945102.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1374925262.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374964549.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374994306.0000000000474000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375014749.0000000000476000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375033609.0000000000478000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375052510.0000000000479000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4ui8luUSNp.jbxd

Similarity

API ID: 1001CountTick$D340InitializeUninitialize
String ID:
API String ID: 170981537-0
Opcode ID: fd852d2fd56ad130941a8ae4ac28a490556950804a47b623a90f708c34cde8c3
Instruction ID: 26568e958bd4a6d25e6f21f5877bd6fb6a39dc953607e13f700d705e0055d867
Opcode Fuzzy Hash: fd852d2fd56ad130941a8ae4ac28a490556950804a47b623a90f708c34cde8c3
Instruction Fuzzy Hash: 7E11E37380424496E7106B55DC063AE3779AB82749F8400FEE408771C6D7FD3A898F9B

Function 0040311F Relevance: 10.6, APIs: 7, Instructions: 54COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040312F
GetTickCount.KERNEL32 ref: 0040313E
1001E6C4.CRTDLL(?,?,000003E8), ref: 00403190
1001D340.CRTDLL(?,?,00000FFF,?,?,000003E8), ref: 004031BF
GetTickCount.KERNEL32 ref: 004031D0
CoUninitialize.OLE32(?,?,?,?,?,000003E8), ref: 004031E9

Memory Dump Source

Source File: 00000000.00000002.1374945102.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1374925262.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374964549.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374994306.0000000000474000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375014749.0000000000476000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375033609.0000000000478000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375052510.0000000000479000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4ui8luUSNp.jbxd

Similarity

API ID: 1001CountTick$D340InitializeUninitialize
String ID:
API String ID: 170981537-0
Opcode ID: 2acea24ac0617f68411d4c36b089ecdfcf1466dfd1b061be7cb2c25f17eb10a6
Instruction ID: 5c345564c67ee5be7f2f46c35482572b1835ee96a61d7fbdf998254a15d7a23c
Opcode Fuzzy Hash: 2acea24ac0617f68411d4c36b089ecdfcf1466dfd1b061be7cb2c25f17eb10a6
Instruction Fuzzy Hash: 3A11E37380424486E7206B65DC067AF366AAB8530AF4404FEF0087B1C2D7BC2A858E9B

Function 00401B81 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00401B88
1001E5C5.CRTDLL(?,%.8X%.8X,00000000,?,?,?,?,?,?,?,?,?,?,?,004017CA,?), ref: 00401BAD
1001F200.CRTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004017CA), ref: 00401BB9
1001E5C5.CRTDLL(004017CA,----------%s,00000000,?,?,?,?,?,?,?,?), ref: 00401BD7

Strings

----------%s, xrefs: 00401BCF
%.8X%.8X, xrefs: 00401BA4

Memory Dump Source

Source File: 00000000.00000002.1374945102.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1374925262.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374964549.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374994306.0000000000474000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375014749.0000000000476000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375033609.0000000000478000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375052510.0000000000479000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4ui8luUSNp.jbxd

Similarity

API ID: 1001$CountF200Tick
String ID: %.8X%.8X$----------%s
API String ID: 3352002681-1631260974
Opcode ID: f6e51c5e6cd62a4c681346519ea6c171e23f02e74d8711897492945bfb2917b0
Instruction ID: 070da3b3857a56ff9989410c10bc9be88267a50a9113a105a97d3b5cffb6c41c
Opcode Fuzzy Hash: f6e51c5e6cd62a4c681346519ea6c171e23f02e74d8711897492945bfb2917b0
Instruction Fuzzy Hash: 0AF096B390020466DF01B6A59C06FFF3675DBC8708F840439F90476182E7B9AA1697BA

Function 00403F7B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

10015765.CRTDLL(c:\tmpe.tmp,00474D86,?,?,?,004038F3,?), ref: 00403F8A
1001C06C.CRTDLL(?,%s,004038F3,004038F3,?), ref: 00403FA0
1001BD6D.CRTDLL(?,?,?,?,004038F3,?), ref: 00403FAB

Strings

%s, xrefs: 00403F98
c:\tmpe.tmp, xrefs: 00403F85

Memory Dump Source

Source File: 00000000.00000002.1374945102.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1374925262.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374964549.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374994306.0000000000474000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375014749.0000000000476000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375033609.0000000000478000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375052510.0000000000479000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4ui8luUSNp.jbxd

Similarity

API ID: 1001$10015765
String ID: %s$c:\tmpe.tmp
API String ID: 4055235427-4072601731
Opcode ID: d108b13151611380978096f998133f0a78c0a39505028fca58d954bade76300d
Instruction ID: 7a8f19d30e304dbe2d2c0cdedb76028b958675fde1fc7434abac2603b42fda6a
Opcode Fuzzy Hash: d108b13151611380978096f998133f0a78c0a39505028fca58d954bade76300d
Instruction Fuzzy Hash: 03D012E2D40108B6CF107BA2DC07DAF7A68DA91754B14817AFD08341A1F6B69B209A9A

Function 0040126A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

1001F200.CRTDLL(?), ref: 00401274
1001F24C.CRTDLL(00000003,hlp,00000003), ref: 00401290
1001F200.CRTDLL(?), ref: 004012A7

Strings

hlp, xrefs: 00401288

Memory Dump Source

Source File: 00000000.00000002.1374945102.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1374925262.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374964549.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374994306.0000000000474000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375014749.0000000000476000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375033609.0000000000478000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375052510.0000000000479000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4ui8luUSNp.jbxd

Similarity

API ID: 1001$F200
String ID: hlp
API String ID: 1770347420-549983773
Opcode ID: 68543c3839008495c4bf1aa77d59df2cf9b2815bf768329c7bee74215e9e30d7
Instruction ID: 26f4a6c6800ed68aaa398b24427ac9acce5a27661276cc51f16232d61dd8676a
Opcode Fuzzy Hash: 68543c3839008495c4bf1aa77d59df2cf9b2815bf768329c7bee74215e9e30d7
Instruction Fuzzy Hash: 570167F1D00144BBEF116A82DC02B9E3B64DB80354F14007BF805BA2B1E67ADF95968A

Function 004046CD Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39windowCOMMON

Download Yara Rule

APIs

LoadIconA.USER32(00000000,00007F00), ref: 00404710
LoadCursorA.USER32(00000000,00007F00), ref: 00404722
GetStockObject.GDI32(00000000), ref: 0040472F

Strings

JE@, xrefs: 00404747

Memory Dump Source

Source File: 00000000.00000002.1374945102.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1374925262.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374964549.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374994306.0000000000474000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375014749.0000000000476000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375033609.0000000000478000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375052510.0000000000479000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4ui8luUSNp.jbxd

Similarity

API ID: Load$CursorIconObjectStock
String ID: JE@
API String ID: 3711576554-2040409044
Opcode ID: 1772a8d5ef51f78be71efd7061b2a8bf6caeb5e0a90294bb6448d515c7de0aea
Instruction ID: 0e73769fb29e94a48444b9859cc011a2465a944df5101fbcc4130c011442d8f4
Opcode Fuzzy Hash: 1772a8d5ef51f78be71efd7061b2a8bf6caeb5e0a90294bb6448d515c7de0aea
Instruction Fuzzy Hash: 4B01927A904719ABDB109F11C80178ABBA5FB487B4F15811AED4C6B780C3B4FA55CFD4

Function 00402BFD Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

10015765.CRTDLL(00407820,00474D86), ref: 00402C0C
1001C06C.CRTDLL(?,%s,?), ref: 00402C22
1001BD6D.CRTDLL(?), ref: 00402C2D

Strings

%s, xrefs: 00402C1A

Memory Dump Source

Source File: 00000000.00000002.1374945102.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1374925262.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374964549.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374994306.0000000000474000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375014749.0000000000476000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375033609.0000000000478000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375052510.0000000000479000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4ui8luUSNp.jbxd

Similarity

API ID: 1001$10015765
String ID: %s
API String ID: 4055235427-620797490
Opcode ID: 3603271048bf87f8e9cb3d7723c1328a5ec83af5b8a0ac1565be9ee3481bccc9
Instruction ID: 0a42463306d5522c39ef9a7c140a24115bfd7d8377342e39bda7d44fbd6ffd06
Opcode Fuzzy Hash: 3603271048bf87f8e9cb3d7723c1328a5ec83af5b8a0ac1565be9ee3481bccc9
Instruction Fuzzy Hash: 8AE0E6B2D40104FACF107B52DD07D9E7A64D681754B248176FD05301A2E6755B209E5A

Function 0040109A Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

10012226.CRTDLL(0000000B,00000000), ref: 0040114E
10012226.CRTDLL(00000008,00000000), ref: 00401168
10012226.CRTDLL(00000000), ref: 00401187
1001242C.CRTDLL ref: 00401195

Memory Dump Source

Source File: 00000000.00000002.1374945102.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1374925262.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374964549.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374994306.0000000000474000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375014749.0000000000476000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375033609.0000000000478000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375052510.0000000000479000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4ui8luUSNp.jbxd

Similarity

API ID: 10012226$1001242
String ID:
API String ID: 2107281119-0
Opcode ID: 583458a6845393a341e643697e8c2f5bc989cf30387a0ad0224e342915684ed6
Instruction ID: 4a81594681d66c589824d65a12c9b8e93df4319547ef2d200cffc92cb1cc33c0
Opcode Fuzzy Hash: 583458a6845393a341e643697e8c2f5bc989cf30387a0ad0224e342915684ed6
Instruction Fuzzy Hash: C8310C71900204EBDB10DF18EC81B667B74FB08360F044576FE19AB3E1E738A964CBA4

Function 004021DA Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402202
TerminateThread.KERNEL32(00000000), ref: 0040224C
closesocket.WSOCK32(00000000), ref: 0040227A
closesocket.WSOCK32(00000000), ref: 004022A8

Memory Dump Source

Source File: 00000000.00000002.1374945102.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1374925262.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374964549.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1374994306.0000000000474000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375014749.0000000000476000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375033609.0000000000478000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1375052510.0000000000479000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4ui8luUSNp.jbxd

Similarity

API ID: closesocket$CountTerminateThreadTick
String ID:
API String ID: 564561751-0
Opcode ID: 1f292f88eb347fb35c8a91462303bc074a1286dbc2053aa302834e3e9bfbf855
Instruction ID: 9ea25df2fa8154756c13685066d749152263f9bba9160f52d63d8d6afbee50b6
Opcode Fuzzy Hash: 1f292f88eb347fb35c8a91462303bc074a1286dbc2053aa302834e3e9bfbf855
Instruction Fuzzy Hash: CB218D72401209EEDB04DB54DB0938DBBB6E781328F65417FC140371E6C7B96A45EE5C

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 4ui8luUSNp.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_videodrv.exe_f6d8b9a778a7455c8af830ba75e9f121b7a76916_a33d36b7_b724bf6b-3898-4295-887d-e3592b506ab1\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREDB9.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREF6F.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREFAF.tmp.xml

C:\Users\user\AppData\Local\VirtualStore\Windows\eml.tmp

C:\Windows\appcompat\Programs\Amcache.hve

C:\Windows\eml.tmp

C:\Windows\exe.tmp

C:\Windows\videodrv.exe

C:\Windows\videodrv.exe:Zone.Identifier

C:\Windows\zip.tmp

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Windows Analysis Report
4ui8luUSNp.exe

Function 004043D0 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 142
filelibraryregistryCOMMON

Function 00404E52 Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 89
registryfileprocessCOMMON

Function 004055A4 Relevance: 4.5, APIs: 3, Instructions: 47
COMMON

Function 004011CB Relevance: 3.0, APIs: 2, Instructions: 36
COMMON

Function 004032D7 Relevance: 44.2, APIs: 22, Strings: 3, Instructions: 416
comCOMMON

Function 00401469 Relevance: 43.9, APIs: 23, Strings: 2, Instructions: 179
COMMON

Function 00402C3E Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 102
fileCOMMON

Function 00403FB6 Relevance: 94.8, APIs: 41, Strings: 13, Instructions: 279
networkCOMMON

Function 00401E58 Relevance: 66.7, APIs: 31, Strings: 7, Instructions: 230
networkCOMMON

Function 0040241C Relevance: 63.3, APIs: 34, Strings: 2, Instructions: 299
networkCOMMON

Function 00403976 Relevance: 51.1, APIs: 24, Strings: 5, Instructions: 383
COMMON

Function 00404FB8 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 75
fileCOMMON

Function 00402E85 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 102
fileCOMMON

Function 00404932 Relevance: 24.2, APIs: 16, Instructions: 165
COMMON

Function 00404751 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 110
sleepfileCOMMON